Optus hacker releases over 10,000 customer details and demands $1 million in cryptocurrency, apologizes later

09/30/2022 / By Belle Carter

The hacker behind the attack against Australian telecommunications provider Optus released more than 10,000 customer records and demanded U.S.$1 million in cryptocurrency. But the cybercriminal bizarrely apologized later and promised not to leak almost 10 million Australian customers’ information.

Hidden under the user name “OptusData,” the hacker stole personally identifiable information (PII) records of 9.8 million Australians, including driver’s licenses, passport numbers, home and email addresses, phone numbers, date of birth and Medicare numbers.

“Only contact onsite! Optus if you wish to contact message onsite! We are businessmen 1.000.000$US is lot of money and will keep to our word. If you care about customer you will pay! Revenue 9B$ dollar, 1M$US small price to pay!” OptusData said in a ransom note posted on an online data breach forum.

That post also included a threat to release more batches each day for the next four days unless demands are met. Within the same thread, hours later, the hacker posted an apology to the people affected by the leak and a claim to have deleted all the stolen data.

“Too many eyes. We will not sale (sic) data to anyone,” the hacker wrote. “We cant (sic) if we even want to: personally deleted data from drive (Only copy).” The cyber attacker said no ransom for the data had been paid as of yet. (Related: Hackers steal over $104 million worth of crypto assets from blockchain bridge.)

Optus CEO Kelly Bayer Rosmarin said the data breach is “not what it is made out to be” because the data was encrypted and the telco giant has “multiple layers of protections.”

“It is not the case of having some sort of completely exposed [application programming interface] API sitting out there. We invest heavily in our cyber defenses, and we really are doing everything we can to ensure that our environment is secure,” Rosmarin said.

However, Optus may sooner than later face a class action filed by law firm Slater and Gordon on behalf of customers affected by the cyberattack.

“This is potentially the most serious privacy breach in Australian history, both in terms of the number of people affected and the nature of the information disclosed,” class action senior associate Ben Zocco said.

They are filing the case for serious consequences the data breach could bring, particularly to vulnerable members of society, such as domestic violence survivors, victims of stalking and other threatening behavior, and people who are seeking or have previously sought asylum in Australia.

Customers alerted of “cash in” scams, to change their driver’s license numbers courtesy of Optus

Tens of thousands of Optus customers are now being alarmed to be mindful of the new scam doing the rounds as fraudsters attempt to “cash in” on the data breach.

Australian Competition and Consumer Commission-run Scamwatch issued the alert on September 27, warning customers that scammers will try to offer false compensation following last week’s cyberattack.
“Beware of scams claiming you’re eligible for financial compensation for identity theft,” the website posted, including a photo of an example email.

Cybersecurity experts such as Alastair MacGibbon from CyberCX are skeptical that the hackers will do as they promised to remove the leaked customers’ PII on the world wide web.

“I don’t believe it. I don’t trust criminals,” MacGibbon told Today. “That means this data is still out there. Can’t put it back in that bottle.”

Meanwhile, Australians victimized by the massive breach will be able to change their driver’s license numbers and get new cards, with Optus expected to shoulder the multimillion-dollar cost of the changeover.

Toby Murray, an associate professor in cybersecurity at the University of Melbourne, told people who are at risk now as a result of the cyber hacking to start changing their driver’s license numbers or their Medicare card numbers.

Victor Dominello, New South Wales customer service minister, advised impacted customers to apply for the replacement. NSW will charge a $29 replacement fee and will be reimbursed by Optus.

Also, Victorians will get “free” license number replacements and the chance to flag their license record in case of future fraud. “We will request Optus repays the cost of the new licenses to the Victorian government,” a spokesperson said.

Visit CyberWar.news for more news related to cyberterrorism and hacking.

Watch this video where Tom Kirkham, CEO and founder of Iron Tech Security, differentiates the three hacker types.

This video is from the Finding Genius Podcast channel on Brighteon.com.