Group behind Optus breach scraps ransom demand
The group behind the massive Optus breach has scrapped its ransom demand and claims to have deleted the 11 million customers’ records it scraped from the telco’s website.
The attempt to force Optus to pay US$1 million (A$1.54 million) by Friday was dropped hours after the group released a batch of 10,000 Australian customersā sensitive details on a data breach forum on the clear web.
The illegally obtained information includes passport, Medicare and driverās licence numbers, dates of birth, home addresses and information about whether a person is renting or living with parents.
āToo many eyes. We will not sale (sic) data to anyone. We cant if we even want to: personally deleted data from drive (Only copy),ā the group said on Tuesday.
It said it would have alerted Optus to its vulnerability if the telco had a secure method to contact or a bug bounty.
The batch released on Tuesday was still online as of 1.30pm Brisbane time.
Attorney-General Mark Dreyfus told a Labor caucus meeting on Tuesday that the option to allow Australians to change their driver licence numbers was being considered with the Privacy Commissioner.
You might like
Dreyfus said the commissioner wasnāt notified by Optus of the breach involving almost 10 million customers, until late Friday, the day after it was first reported.
āOptus has a responsibility for the privacy of both current and former customers,ā he said.
An ongoing privacy review will be completed this year.
In a statement, Home Affairs Minister Clare OāNeil said she was āincredibly concernedā about reports that Medicare numbers were now being offered for free and for ransom.
āMedicare numbers were never advised to form part of compromised information from the breach,ā she said.
āConsumers have a right to know exactly what individual personal information has been compromised in Optusā communications to them.ā
Two people whose details were exposed in Tuesdayās release of Optus data and who asked to remain anonymous, expressed frustration that it contained personal data that, unlike bank details, couldnāt easily be changed.
Stay informed, daily
āNo one can put a price on privacy but Optus has certainly lost mine,ā a Melbourne man told AAP.
āWeāll find out how easy a mistake it was to make and to not make but cāmon, guys. Really?ā said a Canberra man who signed to Optus in 2021.
A check of 12 random email addresses against records held by Have I Been Pwned found nine had not previously been exposed in breaches.
Government Services Minister Bill Shorten said Optus hadnāt done enough to protect customers and its response āneeds to be much more diligent.ā
āItās time for ā¦ a big overhaul of how our data is kept by big corporations,ā he told the Nine Networkās Today.
Optus says it was the victim of a sophisticated attack ā a characterisation dismissed by OāNeil.
She launched a scathing attack on Optus in parliament on Monday, saying responsibility laid squarely at the feet of the telco giant.
A federal police investigation has been launched into the data breach, which has affected 9.8 million Australians.
Opposition cyber security spokesman James Paterson told Sky News the government bore some responsibility and criticised its response to the hack as āslowā.
Optus says it will offer āthe most affectedā customers the chance to take up a one-year subscription to credit monitoring service Equifax Protect at no cost.
āPlease note that no communications from Optus relating to this incident will include any links as we recognise there are criminals who will be using this incident to conduct phishing scams,ā a statement said.
Want to see more stories from InDaily Qld in your Google search results?
- Click here to set InDaily Qld as a preferred source.
- Tick the box next to "InDaily Qld". That's it.
