Total Incidents: According to Rankiteo, Optus has faced 6 incidents in the past.

Incident Types: The types of cybersecurity incidents that have occurred incidents Ransomware, Cyber Attack and Breach.

Total Financial Loss: The total financial loss from these incidents is estimated to be $140 million.

Detection and Response: The company detects and responds to cybersecurity incidents through incident response plan activated with True and communication strategy with Public apology and statement.

Common Attack Types: The most common types of attacks the company has faced is Breach.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Misconfigured API and Unauthenticated API Endpoint.

Average Financial Loss: The average financial loss per incident is $23.33 million.

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Personally identifiable information, Customer records, names, dates of birth, phone numbers, email addresses, physical addresses, driver’s licence numbers, passport numbers, Identity document numbers, Driver's license numbers, User data records, Personal Identification Information and Bank Account Information.

Ensuring Regulatory Compliance: The company ensures compliance with regulatory requirements through Civil penalty order sought by AIC.

Key Lessons Learned: The key lessons learned from past incidents are Organizations holding personal information need to ensure they have strong data governance and security practices to guard against vulnerabilities that threat actors will be ready to exploit.

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Australian Information CommissionerDate Accessed: 2024-08-08, and Source: Intruder.

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through was Public apology and statement.

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: was Public apology and statement.

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Investing in the security of customers’ information, systems, and cyber defence capabilities.

Last Ransom Demanded: The amount of the last ransom demanded was True.

Last Attacking Group: The attacking group in the last incident were an Hackers, Dennis Su and OptusData.

Most Recent Incident Detected: The most recent incident detected was on 2022-09.

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2022-09.

Highest Financial Loss: The highest financial loss from an incident was 140 million AUD.

Most Significant Data Compromised: The most significant data compromised in an incident were Personal details of 9.5 million Australians, Millions of customer records, names, dates of birth, phone numbers, email addresses, physical addresses, driver’s licence numbers, passport numbers, Identity document numbers, Driver's license numbers, User data records, Name, Date of Birth, Phone Number, Address and Bank Account Information.

Most Significant System Affected: The most significant system affected in an incident was Accellion’s FTA.

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Personal details of 9.5 million Australians, Millions of customer records, names, dates of birth, phone numbers, email addresses, physical addresses, driver’s licence numbers, passport numbers, Identity document numbers, Driver's license numbers, User data records, Name, Date of Birth, Phone Number, Address and Bank Account Information.

Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 18.6M.

Highest Ransom Demanded: The highest ransom demanded in a ransomware incident was $2000.

Most Significant Legal Action: The most significant legal action taken for a regulatory violation was Civil penalty order sought by AIC.

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Organizations holding personal information need to ensure they have strong data governance and security practices to guard against vulnerabilities that threat actors will be ready to exploit.

Most Recent Source: The most recent source of information about an incident are Australian Information Commissioner and Intruder.

Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing.

Most Recent Customer Advisory: The most recent customer advisory issued was was an Public apology and statement.

Most Recent Entry Point: The most recent entry point used by an initial access broker were an Unauthenticated API Endpoint and Misconfigured API.

Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Misconfigured API and inadequate security practices, Broken Authorization.

Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Investing in the security of customers’ information, systems, and cyber defence capabilities.