Optus Data Breach: Internet-Facing API Leaks Records of ~9.5–9.8 Million Australians
Between 17 and 20 September 2022 an attacker extracted customer records from Australian carrier Optus via an Internet-facing API; Optus said up to 9.8 million records were affected, while the ACMA later cited over 9.5 million current and former customers.
02Deep-Dive Technical Analysis
Early reporting described an unauthenticated API endpoint. The ACMA's 2024 Federal Court filing alleges access controls existed, but a coding error dating from 2017 left them ineffective on the domain api.www.optus.com.au; Optus fixed the issue on its main domain in August 2021 but not on that dormant subdomain. Records exposed included names, dates of birth, phone numbers and emails, plus addresses for about 3.2 million people and passport or driver's licence numbers for about 2.5 million. The ACMA described the attack as "not highly sophisticated." Optus disputes the allegations.
03Vulnerability & Exploit Flow
An access-control coding error on a forgotten Internet-facing API domain allowed bulk retrieval of customer records.
04Recommended Defense & Mitigation Protocol
API inventory and decommissioning of dormant domains, object-level authorization testing, rate limiting and minimal retention of identity-document numbers.
05Security Impact & Geopolitical Consequence
One of Australia's largest breaches; it triggered ACMA (2024) and OAIC (2025) Federal Court proceedings, a class action, mass re-issuing of identity documents, and tougher privacy penalties.
06Authoritative Standards & External References
07Related Topic Cluster Records
Master 5G Core, SS7 Defense & Subsea Cable Auditing
Ready to turn your historical knowledge into certified hands-on expertise? Register free on TelcoSec Academy to access interactive lab challenges, or consult our enterprise team for carrier-grade signaling assessments and portable BTS hardware.