 |
| Optus Data Breach: Coding Error Exposes Personal Information of 9.5 Million Customers |
A court filing on Wednesday included a report by Australia's Communications and Media Authority (ACMA), which is using its regulatory authority to pursue Optus. According to the Authority, Optus stored customer information and made it accessible to authenticated customers through its domains www.optus.com.au (Main) and api.optus.com.au (Target). Accessing this data required the use of "Target APIs."
The Target domain was intended to separate API traffic from static content on the Main domain and had been publicly accessible since 2017, secured by various access controls. However, a coding error in 2018 compromised one of these controls, affecting both domains.
Optus identified and fixed the error on the Main domain in 2021 but failed to address it on the Target domain, which remained online and accessible. The court filing indicates that the Target domain was not decommissioned despite being unnecessary.
In September 2022, an attacker bypassed the access controls and accessed the Target APIs, retrieving information on 9.5 million customers. This incident caused significant issues for Optus and its Singaporean parent company, Singtel.
The court filing describes the cyber attack as unsophisticated, requiring no advanced skills or internal knowledge of Optus’s systems, and was carried out through simple trial and error. Optus has not disputed this account of the breach.
ACMA is seeking civil penalties against Optus. Singtel has informed investors that while it cannot determine the extent of the penalties, it plans to defend the case.
0 Comments