Optus, one of Australia’s largest telecommunications carriers, reported news of a data breach that may have compromised the information of current and former customers.
As of this writing, the company has not stated how many customers may have been affected, citing their ongoing investigation in conjunction with law enforcement and Australian government officials
According to Optus, the breach may have included the following:
“Information which may have been exposed includes customers’ names, dates of birth, phone numbers, email addresses, and, for a subset of customers, addresses, ID document numbers such as driver’s license or passport numbers. Payment detail and account passwords have not been compromised.”
Optus is currently notifying customers who may have been affected by this breach with SMS and email messages. However, the company makes an important distinction here:
“We are not sending links in SMS or emails. If customers receive an email or SMS with a link claiming to be from Optus, they are advised that this is not a communication from Optus. Please do not click on any links.”
Often in the wake of such breaches, cybercriminals will send out phony communications that use the name of the company affected. These can include phishing attacks over email and SMS that solicit personal and account information or other tactics that attempt to capitalize on the announced breach.
Optus continues to keep its customers up to date on the latest developments on its website, which includes a comprehensive FAQ that details what happened, what steps are being taken, and what customers can do in the wake of this announcement.
What should I do if I think my information was caught up in the Optus breach?
Any time a data breach occurs, your exposed personal information may be used by those trying to commit identity fraud or theft. Different pieces of personal information can be more useful to them than others.
Some information is directly useful, such as a driver’s license or credit card information because they identify you right away. Others are indirectly helpful, like device IDs, browsing history, geolocation information, and internet protocol addresses. While they don’t identify you on their own, a cybercriminal could piece together your identity if they have enough indirect information about you.
In light of this, there are a few steps you can take to protect yourself in the aftermath of a data breach, which involve a combination of preventative steps and some monitoring on your part.
Work with a credit and identity recovery pro
If you become the victim of fraud or theft after a data breach, a licensed recovery pro can help you restore your credit and identity. If you’ve ever dealt with fraud or theft before, or know someone who has, recovery can be a time-consuming and stressful process if you undertake it alone. With McAfee+ Advanced, you have around-the-clock support from a restoration expert with limited power of attorney who can take the steps that can help restore your credit and identity.
Working with an expert can lend you extra peace of mind, particularly in a time where there’s plenty of uncertainty. First, you’ll know that a professional is working on your case—a person who knows exactly where to start and what needs to happen for the best possible outcome. Second, you’ll get precious time back, time you’d otherwise have to spend if you took on the process yourself.
Keep an eye out for phishing attacks
As mentioned above, with some personal information in hand, cybercriminals may seek out more. They may follow up a breach with rounds of phishing attacks that direct you to bogus sites designed to steal your personal information—either by tricking you into providing it or by stealing it without your knowledge. So, it’s always wise to keep a skeptical eye open for unsolicited messages or phone calls that ask you for information in some form or other, often in ways that urge or pressure you into acting.
Consider using identity monitoring
An identity monitoring service can monitor your information from email addresses to IDs and phone numbers for signs of breaches so you can take action to secure your accounts before they’re used for identity theft. Personal information harvested from data breaches can end up on dark web marketplaces where it’s bought by other cybercriminals so they can launch their own attacks. McAfee monitors the dark web for your personal info and provides early alerts if your data is found, an average of 10 months ahead of similar services. We also provide guidance to help you act if your information is found.
Change your passwords and use a password manager
While it does not appear that login information was affected, a password update is still a strong security move. Strong and unique passwords are best, which means never reusing your passwords across different sites and platforms. Using a password manager will help you keep on top of it all, while also storing your passwords securely. Moreover, changing your passwords regularly may make a stolen password worthless because it’s out of date.
Enable two-factor authentication
While a strong and unique password is a good first line of defense, enabling two-factor authentication across your accounts will help your cause by providing an added layer of security. It’s increasingly common to see nowadays where banks and all manner of online services will only allow access to your accounts after you’ve provided a one-time passcode sent to your email or smartphone. If your accounts support two-factor authentication, enable it.
Clean up your personal data online
Mentioned earlier, information stolen in a data breach may indirectly identify you. Yet when pieced together with other information, it can then directly identify you. One way cybercriminals complete this identity picture puzzle is with information provided by data brokers that buy and sell personal information online. However, you can take some control over this. Our Personal Data Cleanup service scans high-risk data broker sites for your personal information and then helps you remove it—which denies cybercriminals the information they may need to commit identity theft.
Check your credit and consider a credit freeze
When personal information gets released, there’s a chance that a hacker, scammer, or thief will put it to use. This may include committing fraud, where they draw funds from existing accounts, and theft, where they create new accounts in a victim’s name.
Even though it’s believed that no payment information was involved in this breach, customers should still take steps to monitor their statements and their overall credit report so that they can spot and address any unusual activity. Optus has announced that it will offer affected customers 12 months of credit and identity monitoring through Equifax, one of the major global credit agencies, at no cost.
Another step that customers can take is to place a credit freeze on their credit reports with the major credit agencies in Australia— Equifax, illion, and Experian. This will help prevent cybercriminals from opening new lines of credit or taking out loans in a victim’s name by “freezing” their credit report so that potential creditors cannot pull it for reference. Terms of freezing a credit report will vary, so check with each agency for details.
Consider using comprehensive online protection
A complete suite of online protection software can offer layers of extra security for future protection. In addition to more private and secure time online with a VPN, identity monitoring, and password management, protection like McAfee+ Advanced includes web browser protection that can block malicious and suspicious links that could lead you down the road to malware or a phishing scam—which antivirus protection can’t do alone.
Should I replace my driver’s license and passport for a new ID number?
Per Optus, a subset of those affected may have had their driver’s license and/or passport ID number affected by the breach. Given that license and passport ID numbers are such unique pieces of personally identifiable information, anyone notified by Optus that theirs may have been affected should strongly consider changing them.
The process for replacing either document will vary depending on your state or territory. Given the scope of the attack, some states and territories have proposed making exceptions to the rules for attack victims. As of this writing, that picture continues to evolve, so look to your local government for guidance.
The Optus data breach – you have ways to protect yourself
Not all data breaches make the news. Businesses and organizations, large and small, have all fallen victim to them, and with regularity. The measures you can take here are measures you can take even if you don’t believe you were caught up in the Optus breach. As you can see, several of them are preventative, which is important because word of data breaches tend to reach customers days, weeks, or even months after they’ve been discovered—leaving cybercriminals plenty of opportunity to commit all kinds of identity crime in the meantime.
In this case, the breach certainly made the news due to its apparent size and scale. And as Optus works with law enforcement and government officials, more details into the attack and who has been affected will arise.
However, you have every reason to act now rather than wait for additional news. Staying on top of our credit and identity has always been important, but given all the devices, apps, and accounts we keep these days leaves us more exposed than ever, making protecting ourselves a must.