Optus 2022 Data Breach: 9.8 Million Australian Customer Records Exposed

The Optus breach was caused by an unauthenticated API endpoint that allowed anyone to access customer data without login credentials. This basic security failure catalyzed significant privacy law reform in Australia with increased penalties to $50 million AUD.

The breach at Optus exposed 9.8 million records through unauthenticated api endpoint exposed customer data without requiring login. 9.8 million Optus customers — approximately 40% of Australia population The incident highlights the ongoing challenges organizations face in protecting sensitive user data against increasingly sophisticated attack vectors. Security researchers have noted that breaches of this magnitude often result from a combination of technical vulnerabilities and organizational failures in security practices.

Current status: Class action ongoing; catalyzed Australian privacy law reform. Affected users should take immediate steps to protect their accounts, including changing passwords, enabling multi-factor authentication, and monitoring financial accounts for unauthorized activity. Filing a DSAR with Optus can help you understand what data was exposed and request its deletion.