Optus customer data breach via API with broken access controls
Between September 17 and 20, 2022 an attacker sent requests to an internet-facing Optus API that returned customer personal information without valid authorization. ACMA alleges a 2018 coding error in the API's access controls left it open, and that Optus fixed the same error on its main domain in 2021 but not on the dormant API domain. Optus disclosed the breach on September 22, 2022.
- Victim
- Optus (Singtel Optus)
- Industry
- Telecom
- Country
- Australia
- Intrusion began
- Sep 17, 2022
- First disclosed
- Sep 22, 2022
- Actor
- Unattributed
- Initial access
- Misconfiguration
- Identity control that failed
- Authorization
- MFA
- Not applicable (no interactive login)
- Abused identity
- Human account
- Records affected
- 9.5 million (About 9.5 million current, former and prospective customers, per the OAIC; Optus first reported up to 9.8 million records.)
- Disclosed cost
- Not disclosed
The identity lesson
Every API that returns personal data must enforce authentication and object-level authorization, with dormant endpoints removed and access control tests in the release pipeline.
Regulatory and legal outcome
May 2024: ACMA filed Federal Court proceedings alleging Optus failed to protect customer information under the Telecommunications Act. August 8, 2025: the OAIC announced civil penalty proceedings alleging one Privacy Act contravention per affected individual, with up to A$2.22 million per contravention.
Sources
- Optus notifies customers of cyberattack, Optus, Sep 22, 2022
- Australian Information Commissioner takes civil penalty action against Optus, Office of the Australian Information Commissioner, Aug 8, 2025
- Optus breach allegedly enabled by access control coding error, iTnews, Jun 20, 2024
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- UNC6040 voice phishing campaign against Salesforce customers 2025 · Consent phishing
- Coinbase customer data stolen through paid overseas support staff 2025 · Insider misuse
- Cyberhaven Chrome extension hijacked through OAuth consent phishing 2024 · Consent phishing
- AT&T call and text records stolen from its Snowflake workspace 2024 · Stolen credentials
Cite this record
SWI Community Team. (2026). Optus customer data breach via API with broken access controls. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2022-optus-unauthenticated-api/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.