Optus leaves an API exposed, and 10 million Australians' ID data leaks

In late September 2022, Australia's second-largest telecommunications provider, Optus, disclosed a data breach that exposed the personal information of up to 10 million current and former customers. The compromised data included names, dates of birth, contact details, and — critically — passport and driver's licence numbers for about 2.1 million people, the kind of identity documentation that can be used for fraud.

The cause was not a sophisticated attack but a coding oversight. An application programming interface that accepted customer requests was left exposed to the internet without proper access controls, allowing an attacker to query it for customer records. The breach was detected in the third week of September 2022, and Optus said customer identification documents had been compromised.

The financial and regulatory consequences were severe. Optus's parent company, Singtel, reserved A$140 million to cover the costs of the incident. Australia's privacy regulator, the OAIC, and the communications regulator ACMA opened investigations, and the government funded a A$5.5 million public awareness campaign. A class action led by law firm Slater and Gordon drew in roughly 100,000 customers seeking compensation.

The decision behind the failure was an engineering one: a customer-facing API was deployed without the access-control checks that should have kept it private, and the onboarding of the service did not treat identity data as the sensitive asset it is. A single configuration error placed the identity records of millions of Australians at risk.