Optus, 2022: 9.5 million Australians, and a case still before the court.

The Commissioner's announcement of the proceedings alleges that Optus failed to take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure, as the Privacy Act 1988 requires. The investigation looked at whether Optus managed cybersecurity and information security risks in a way proportionate to the volume of personal data it held and its size.

The announcement does not set out the technical method of the attack, and the allegations are before the court, so this page does not describe one. What the OAIC does publish is a list of lessons for every organisation, which indicates where it sees the risk. It says organisations should:

• implement procedures that ensure clear ownership and responsibility over internet-facing domains;
• ensure that requests for customers' personal information are authorised to access that information;
• layer security controls to avoid a single point of failure;
• implement robust security monitoring so vulnerabilities are detected and incidents responded to in time;
• appropriately resource privacy and cyber security, including when outsourced to third parties; and
• regularly review practices and systems, including critical and sensitive infrastructure.

The first two points are specific: someone must own every internet-facing domain, and every request for personal data must be checked for authorisation, not just authentication.

• People affected: about 9.5 million current, former and prospective customers, as alleged by the Commissioner.
• Data: names, dates of birth, home addresses, phone numbers and email addresses, and for some people passport numbers, driver's licence numbers, Medicare card numbers, and other identity document information. Some of the data was published on the dark web.
• Proceedings: the Commissioner alleges one contravention for each of the 9.5 million people. The Federal Court can impose a penalty of up to A$2.22 million per contravention for the period concerned; whether a penalty is ordered, and how much, is for the court.

This page will not describe the outcome until the court has ruled. It covers the OAIC proceedings only: action by other regulators is not described because their official pages could not be read when the page was checked.

• Domains you may have forgotten: attack surface monitoring finds your subdomains from Certificate Transparency logs and flags expiring and expired certificates, so an internet-facing host without a known owner becomes a finding to assign.
• Testing what is exposed: trytrustable dast runs OWASP ZAP and Nuclei against your own applications and APIs (web security testing), and the SDK's static analysis runs in CI.
• Exposure in the cloud: GCP checks that only intended Cloud Run services are public and that Cloud SQL is not open to the internet; AWS checks that RDS instances are not publicly accessible and that S3 Block Public Access is on.
• Monitoring: AWS CloudTrail, GuardDuty and Security Hub; GCP Data Access audit logs and Security Command Center.
• Response: the incident management module tracks each incident's timeline and regulatory deadlines.

Automated testing finds many access-control flaws but not all: whether a given caller should see a given customer's record is business logic, and needs code review and tests written for it.

These are the checks TryTrustable runs today. None of them is a claim about what would have happened in this incident: they test whether the control is in place in your environment, continuously, and record the result as audit evidence.

• Office of the Australian Information Commissioner: Australian Information Commissioner takes civil penalty action against Optus (August 2025)

Every figure on this page is taken from the official documents listed here, read in October 2026. Regulatory findings quoted are the regulator's; where a company neither admitted nor denied them, or where proceedings are still open, the page says so. Not legal advice.

More case studies: all breach case studies · Research