- First names, last names and work email addresses of 30,000 Telstra staff leaked
- Data posted on the same forum the Optus breach data was posted on last week
- Breach related to a third party programme that used to provide staff rewards
Telstra has been rocked by a data breach with hackers gaining access to the personal information of 30,000 current and former staff.
The names and email addresses of the staff members were posted on the same forum the Optus breach data was posted on last week.
Data unveiled included first names, last names and work email addresses of 30,000 Telstra employees who worked for the company prior to 2017.
It also included the information of 12,800 of employees still employed by the telco.
Telstra’s group executive for transformation, communications and people Alex Badenoch wrote a note to staff on Saturday.
She said the breach related to a third party programme that had previously provided Telstra’s Worklife NAB rewards program for staff.
‘We understand this may cause some anxiety to our people, particularly in the current climate of heightened awareness around cyber security,’ she said.
‘If you wish to find out more about the breach, or to find out if your email address was exposed, please contact our cyber team.
‘In the meantime, we remind you as always to remain vigilant about any unexpected communications.’
She added that the current rewards programme was unaffected, but all user passwords had been reset to be safe.
A Telstra spokesperson told Daily Mail Australia: ‘We’ve been made aware of a data breach affecting a third party that included limited Telstra employee information from 2017.
‘To be clear, it was not a breach of any Telstra systems. The data released is very basic in nature – limited to full names and email addresses used to sign up to the platform.
‘No customer account information was included. We believe it’s been made available now in an attempt to profit from the Optus breach.
‘The relevant authorities have been notified, we’ve let current employees know, and while the data is of minimal risk to former employees, we will attempt to notify them too.
It comes after the massive Optus data hack, with the embattled telco giant on Monday shedding more details on the impact of the breach.
Optus confirmed that the identification details of 2.1 million current and former customers have been exposed in the hack.
Around 1.2 million customers have had at least one number from a current and valid form of identification, and personal information compromised, including 150,000 from passports and 50,000 from Medicare cards.
Optus chief executive Kelly Bayer Rosmarin stated in a new video message that those 1.2 million customers should take action and have already been contacted.
The remaining 900,000 who had expired IDs compromised, in addition to personal information may also need to action, pending updates from licensing authorities.
Around 7.7million customers haven’t had their personal details stolen and don’t need to take action but are urged to remain vigilant.
Optus has also appointed Deloitte to launch to an independent external review of the cyberattack, and its security systems, controls and processes.
Deloitte will undertake a forensic assessment of the cyberattack and the circumstances surrounding it as Optus vowed to regain customers trust.
The update came hours after the telco giant sent a general mass text to impacted customers during the NRL grand final on Sunday night, sparking massive outrage.
‘Cyberattack update: Confirming only the license number on your Driver Licence was exposed, not the card number. Your State or Territory government will provide advice on any action that you may need to take via their website,’ the text from Optus read.
Almost 10million Australians remain at risk of having private and sensitive information sold online after a hacker infiltrated Optus’ system and raided the details of its current and former customers.
‘While the numbers have come down, we are disappointed that even one customer’s information could be affected,’ Ms Bayer Rosmarin states in the new video.
‘And we are deeply deeply sorry that this could occur, especially because we genuinely care about safeguarding our customers’ information.’
She ended the five minute video by reassuring customers Optus was doing everything it can to ensure no harm comes to customers as a result of the cyberattack.
On Sunday morning federal ministers lined up to give Optus a drubbing.
Attorney-General Mark Dreyfus said he was yet to get an explanation why Optus hoarded sensitive personal information of people even after they left the telco.
The data stolen by the hacker came from 10million current or former Optus customers and dated back to 2017.
Cyber Security and Home Affairs Minister Clare O’Neil said that Optus had not done enough to alert those most at risk, particularly the 10,200 people who had their details leaked online by the hacker.
‘Optus has advised it has told those people – an email is simply not sufficient under these circumstances,’ Ms O’Neil told a media conference.
‘We are going to need to go through a process of directly speaking to those 10,200 individuals.
‘Optus needs to take up the mantle here to directly ensure people are aware when they are directly at risk, as those people are.’
She said Optus had failed to provide the government with information on who and how many were at risk.
‘We would like Optus to be transparent about the numbers of people who have had specific identity documents compromised and that information has not yet been provided.’
The criticism was echoed by Services Minister Bill Shorten who said his department had written to Optus on 27 September asking for details on all those whose had Medicare numbers or other Centrelink information stolen, but as yet had no reply.
‘It’s been 11 days since the breach,’ he said.
‘It is most peculiar that we still can’t identify who has had their Medicare information number to be able to get their information.
‘We need this not tomorrow or the next day, we really needed it days ago.’
Ms O’Neill previously called the Optus breach a ‘basic hack’, something Ms Rosmarin denied saying the data had been encrypted and protected by ‘multiple firewalls’.
What Optus has said about the breach:
How did this happen?
Optus was the victim of a cyberattack. We immediately took action to block the attack which only targeted Optus customer data. Optus’ systems and services, including mobile and home internet, are not affected, and messages and voice calls have not been compromised. Optus services remain safe to use and operate as per normal.
Has the attack been stopped?
Yes. Upon discovering this, Optus immediately shut down the attack.
We are now working with the Australian Cyber Security Centre to mitigate any risks to customers. We have also notified the Australian Federal Police, the Office of the Australian Information Commissioner, and key regulators.
Why did we go to the media first instead of our customers?
The security of our customers and their data is paramount to us. We did this as it was the quickest and most effective way to alert as many current and former customers as possible, so they could be vigilant and monitor for any suspicious activity. We are now in the process of contacting customers who have been impacted directly.
What information of mine may have been exposed?
The information which may have been exposed includes customers’ names, dates of birth, phone numbers, email addresses, and, for a subset of customers, addresses, ID document numbers such as driver’s license or passport numbers. Customers affected will be notified directly of the specific information compromised.
Optus services, including mobile and home internet, are not affected. Messages, voice calls, billing and payments details, and account passwords have not been compromised.
What should I do to protect myself if I suspect I am a victim of fraudulent activity?
We are not currently aware of any customers having suffered harm, but we encourage you to have heightened awareness across your accounts, including:
Look out for any suspicious or unexpected activity across your online accounts, including your bank accounts. Make sure to report any fraudulent activity immediately to the related provider.
Look out for contact from scammers who may have your personal information. This may include suspicious emails, texts, phone calls or messages on social media.
Never click on any links that look suspicious and never provide your passwords, or any personal or financial information.
How do I contact Optus if I believe my account has been compromised?
If you believe your account has been compromised, you can contact us via My Optus App – which remains the safest way to contact Optus or call us on 133 937 for consumer customers. Due to the impact of the cyberattack, wait times may be longer than usual.
If you are a business customer, contact us on 133 343 or your account manager.