top of page
Search

Optus Breach 2022: API Exposure and the Cost of Weak Governance

Writer: Rebecca Guy
Rebecca Guy
Oct 4, 2022
6 min read

Updated: Aug 31

No phishing, no malware, no stolen credentials. A four-year-old coding error, a forgotten domain, and an API that never asked who was calling exposed the records of roughly 9.5 million Australians. Some breaches aren't broken into. They're walked into.


Case type: Data exposure / unauthenticated API

Identified: Sept 20, 2022  Disclosed: Sept 22, 2022

Attribution: Unidentified actor, handle "optusdata"





Cybersecurity breaches are often measured in records exposed, systems compromised, or financial losses incurred. Yet for many organizations, the most significant consequence is the impact on customers whose personal information has been entrusted to the business.


The 2022 Optus breach shows how data exposure, governance failures, and inadequate oversight can transform a cybersecurity incident into a major business and reputational crisis. It also breaks the pattern of every other breach in this series: nobody was phished, nobody approved a push notification, nobody answered a call from a fake help desk. The human risk here lived upstream, in engineering decisions made and never revisited, and in an asset that nobody owned. Protecting customer data is not simply a technical responsibility. It is a governance responsibility.




Optus's technical team first noticed suspicious activity on its network on September 20, 2022. The next day, the company confirmed a data breach and notified regulators. On September 22, Optus went public, disclosing that the personal information of current and former customers had likely been accessed, including names, dates of birth, phone numbers, email addresses, and, for some customers, identification document numbers.


The cause, once it became clear, was strikingly low-tech for a breach of this scale, and thanks to regulatory court filings, its anatomy is documented with unusual precision. In September 2018, a coding error released into production, after review and testing, broke the access controls on an Optus API, the backend infrastructure that lets systems like its website pull customer account data. In June 2020, the affected domains became internet-facing. In August 2021, Optus found and fixed the error, but only on its main domain. An identical, dormant secondary domain carried the same flaw, and it was never checked, never fixed, and never decommissioned, despite, in the regulator's words, the lack of any need for it.


Between September 17 and 20, 2022, an attacker found that open door. The API required no authentication: anyone who discovered it could query it directly. And because customer records were assigned sequential ID numbers, one valid record was all it took; the attacker could simply increment the number to pull the next record, and the next, automating the extraction of nearly the entire customer database. Australia's communications regulator would later describe the attack as neither sophisticated nor requiring advanced skills, but "a simple process of trial and error."



The fallout moved fast. On September 23, the attacker, using the handle "optusdata," posted on a hacking forum demanding roughly US$1 million to prevent the data from being sold. On September 26, they posted 10,200 customer records as proof, the same day Australia's Home Affairs Minister publicly placed responsibility for the breach on Optus. On September 27, the attacker abruptly deleted their posts, apologized, and claimed to have destroyed the stolen data, a claim neither Optus nor the Australian Federal Police ever confirmed. By October 11, Australia's privacy and communications regulators had opened formal investigations, and the legal consequences are still unfolding: a class action filed in 2023, Federal Court proceedings by the communications regulator in 2024, and civil penalty proceedings by the privacy regulator in 2025, all still in motion as of this writing.



Optus reported that approximately 2.1 million customers had identity document numbers exposed, 1.2 million of which were still valid at the time of the breach. The remaining roughly 900,000 were expired numbers, though even expired identification can still be useful to someone attempting identity fraud. It became one of the largest and most significant data breaches in Australian history. The regulator's court filing later identified three separate opportunities at which the flaw could have been caught before any data left: the 2018 production release, the 2020 move to internet-facing, and the 2021 fix that stopped one domain short.




Nobody was fooled. The API was exposed.


Every other breach in this series begins with a person being deceived in the moment: a text message, a phone call, a flood of push notifications. This one has no such moment. The door was simply open, and had been for years. That makes it a different kind of human-risk story, one about the decisions organizations inherit from their own past, and it illustrates a fundamental principle:


Sensitive data turns technical exposure into business risk.

Organizations often focus on defending networks and applications, but attackers are ultimately seeking access to information. When that information includes customer identities, financial details, or government-issued identification data, the consequences compound. The breach was not just an IT issue. It became a customer trust issue, a regulatory issue, a governance issue, and a business issue.




A password can be reset. A passport can't.


When personal information is exposed, the impact extends far beyond the organization itself. Affected individuals may face:



Unlike a compromised password, many forms of personal information cannot simply be changed. A customer can reset a password. They cannot easily replace years of personal history, identity records, or information that has already been distributed across criminal networks. Exposed data often remains valuable to attackers long after the initial breach, which is why 1.2 million valid identity documents mattered so much more than any single compromised account ever could.




The fix was applied to the watched door, not the forgotten one


One of the key lessons from the Optus breach is that governance should be viewed as a cybersecurity control in its own right. Governance determines:



Strong governance creates visibility into risk before an incident occurs. Weak governance allows security issues to persist until they become public problems. In Optus's case, the gap between fixing a vulnerability on the main domain in 2021 and never checking whether the same flaw existed elsewhere is exactly the kind of gap governance exists to catch. So is a customer-data API sitting on a dormant, internet-facing domain that nobody needed, nobody owned, and nobody decommissioned. Technology teams play a critical role in cybersecurity, but governance ensures that security responsibilities extend across the organization and into leadership decision-making.




Not one decision. A set of conditions.


The question organizations should ask isn't "how did the attacker find the API?" A more useful question is: what conditions turned one coding error into nearly an entire customer database walking out the door?




Data you no longer need is risk you still hold


The incident also raises important questions about data lifecycle management. Organizations frequently collect information because it may be useful in the future. Over time, large amounts of customer information accumulate across systems, applications, databases, and cloud environments. Retaining sensitive data indefinitely creates additional risk. Organizations should regularly evaluate:



Data that no longer serves a business purpose may still create significant security exposure. Optus's exposed database included records belonging to former customers, not just current ones, which raised its own separate questions about how long that data needed to be kept at all. Reducing unnecessary sensitive-data retention can directly reduce the amount of information exposed if a system is compromised.




Customers judge the response, not just the breach


For many organizations, reputation is among their most valuable assets. A breach can damage trust not only because information was exposed, but because customers also see how the organization communicates, responds, and takes responsibility afterward. Following a major breach, customers naturally begin asking:



The answers to these questions influence customer relationships long after technical recovery efforts have been completed. In Optus's case, the public answer arrived quickly and from the top: within four days of disclosure, a government minister was assigning responsibility by name.









"Governance Is a Security Control."


The Optus breach demonstrates that cybersecurity is ultimately about protecting people as much as it is about protecting systems. The exposed information represented more than records in a database. It represented real customers whose identities, privacy, and trust were placed at risk by decisions made years before anyone came looking.


As organizations collect and store increasing amounts of personal information, governance becomes as important as technology. Asset inventories, remediation follow-through, data retention decisions, and named accountability all determine whether sensitive information stays protected. Customer data is one of an organization's most valuable assets, and one of its most significant responsibilities.


BECAUSE THE MOST EXPENSIVE BREACHES AREN'T ALWAYS BROKEN INTO. SOME ARE WALKED INTO, THROUGH A DOOR NOBODY REMEMBERED WAS THERE.



Sources


Comments

bottom of page