‘Compromised’: New Optus hack detail

The telco confirmed there were about 1.2 million customers that had at least one form of current and valid identification and personal information accessed by hackers.

“Optus has communicated with these customers and recommended that they take action to change their identification documents,” the company said in a statement.

Further, there were about 900,000 customers who had numbers from expired identification documents stolen, as well as personal information.

“We continue to work with governments and agencies regarding what further steps, if any, those customers should take,” the telco said.

Optus confirmed the numbers after what it described as “extensive ongoing engagement with more than 20 federal, state and territory government agencies and departments”.

With the data of about 9.8 million customers caught up in the cyber attack, there are more than 7.7 million people who did not have ID numbers accessed by hackers.

These 7.7 million Australians are still warned to be on alert for scammers as they had data such as email addresses, date of birth and phone numbers taken.

The updated information comes as Optus announces an external review into how the data was breached.

Consulting agency Deloitte will conduct the probe into the embattled telco’s cybersecurity systems, controls, processes and the circumstances surrounding the cyber attack.

In a statement, Optus said the review was recommended by chief executive Kelly Bayer Rosmarin and was supported unanimously by the Singtel Board, the telco’s parent company.

“While our overwhelming focus remains on protecting our customers and minimising the harm that might come from the theft of their information, we are determined to find out what went wrong,” the telco said.

“This review will help ensure we understand how it occurred and how we can prevent it from occurring again.”

Texts sent by Optus to customers who have had their IDs stolen has caused outrage, with some describing it as confusing.

“Cyberattack update: Confirming only the licence number on your driver’s licence was exposed, not the card number,” the text from Optus read.

“Your state or territory government will provide advice on any action that you may need to take via their website.”