Budget focus on Optus hack

Hidden within the October budget papers is a two-year investment for the Office of the Australian Information Commissioner (OAIC), a department that has seen its workload increase amid rising hacks and cyber attacks on businesses and individuals.

The watchdog began an investigation into Optus’ “personal information handling practices” on September 22, after a massive cyber attack saw data from 9.8 million Australians accessed by hackers.

“The OAIC’s investigation will focus on whether the Optus companies took reasonable steps to protect the personal information they held from misuse, interference, loss, unauthorised access, modification or disclosure, and whether the information collected and retained was necessary to carry out their business,” the watchdog said in a statement.

If the investigation finds that Optus seriously interfered with customers privacy, Optus could face civil penalties of up to $2.2 million for each contravention.

The telecommunications company initially failed to tell the federal government that Medicare card numbers, driver’s licences and passport numbers had been compromised in the attack.

Approximately 1.2 million Optus customers had at least one form of current ID accessed by the hackers.

Other customer data such as names, phone numbers, dates of birth and email addresses were also compromised, opening millions of Australians up to the risk of scams.

The Information Commissioner Angelene Falk has previously described the attack as Australia’s largest since 2018 when the Notifiable Data Breaches scheme was brought in.

Ms Falk has called on the Labor government to allocate more funds to the OAIC, saying that the office was “unable to keep up” with increasing demands, particularly for freedom of information requests.