Has your data been stolen in the Optus data breach? Here's exactly what to do.

Almost 10 million Aussies have had their personal details compromised following a major cyber attack on Optus last week. 

The attack is currently being investigated by the Australian Federal Police, who are working to identify the people behind the breach and to prevent identity fraud of those affected. 

"We are aware of reports of stolen data being sold on the dark web and that is why the AFP is monitoring the dark web using a range of specialist capabilities," said Assistant Commissioner of Cyber Command Justine Gough.

"Criminals, who use pseudonyms and anonymising technology, can't see us but I can tell you that we can see them."

Optus announced they were hit by the attack last Thursday, saying they immediately shut the breach down.

"We are devastated to discover that we have been subject to a cyberattack that has resulted in the disclosure of our customers’ personal information to someone who shouldn’t see it," Optus CEO, Kelly Bayer Rosmarin, said at the time.

"We are very sorry and understand customers will be concerned. Please be assured that we are working hard, and engaging with all the relevant authorities and organisations, to help safeguard our customers as much as possible."

Slater and Gordon Lawyers are investigating whether to launch a class action lawsuit against Optus on behalf of former and current customers.

Class actions senior associate Ben Zocco said the leaked information posed a risk to vulnerable people, including domestic violence survivors and victims of stalking.

Prime Minister Anthony Albanese said the data breach was a "huge wake-up call".

As the government prepares to introduce new cybersecurity measures, Albanese said the new protections would mean banks and other institutions would be informed much faster when a breach happened so personal data could not be used.

As more developments come to light about the attack, here's what you need to know. 

What information may have been accessed? 

Customers' names, dates of birth, phone numbers, email addresses, driver's licence numbers, passport numbers or addresses could have been accessed in the attack, Optus has confirmed. 

However, they assure payment details and account passwords have not been compromised.

What has the hacker said?

On Tuesday morning, the alleged hacker behind the data breach announced they had reportedly released 10,000 customer records and promised more would follow if Optus did not pay AUD$1.5 million in Monero cryptocurrency. 

In a statement, the hacker, known as "OptusData" said 10,000 records would be released daily until the money is paid.

"Four more days to decide Optus!" they wrote in the statement, which was shared on Twitter by Brett Callow, an employee from New Zealand-based cyber security company Emsisoft.

The #Optus hacker has released 10k records, and claims that another 10k will be released each day for the next 4 days. 1/2 pic.twitter.com/Nm07oQhMZl

— Brett Callow (@BrettCallow) September 26, 2022

However, hours later, the alleged hacker said they couldn’t release more data because they had "personally deleted data from drive", which they claimed was the only copy.

They also apologised to Optus and Aussies impacted by the data breach. 

"Sorry too 10.200 Australian whos data was leaked [sic]," they wrote before saying, "deepest apologises to Optus for this. Hope all goes well from this."

It seems the #Optus hacker got cold feet. That said, one forum member seems to think there's more to the story. 1/2 pic.twitter.com/pG2RoxuSjB

— Brett Callow (@BrettCallow) September 27, 2022

I'm an Optus customer, what should I do? 

In light of the attack, Optus encourages customers to have "heightened awareness across your accounts". This means:

• Keep a lookout for any suspicious or unexpected activity across your online accounts and report any fraudulent activity immediately to the related provider.
• Keep a lookout for contact from scammers who may have your personal information, including suspicious emails, texts, phone calls or messages on social media.
• Never click on any links that look suspicious or provide your passwords, or any personal or financial information.

Scamwatch has also advised Optus customers to secure their personal information by changing online account passwords and enabling multi-factor authentication for banking.

Australian Consumer and Competition Commission deputy chair Delia Rickard said any Optus customers who suspected they were victims of fraud should request a ban on their credit records and be highly sceptical of unexpected calls from people purporting to represent banks or government agencies.

I'm an Optus customer, how do I know if my privacy has been compromised?

Optus told Mamamia, "The attack is being investigated by the Australian Federal Police, and they have advised Optus not to provide comment on certain aspects of the investigation, including verifying the number of customers impacted."

However, they confirmed they have sent email or SMS messages to all customers whose ID document numbers, such as licence or passport number, were compromised because of the cyberattack.

"We continue to reach out to customers who have had other details, such as their email address, illegally accessed," they said.  

If your licence was compromised in the attack, and you live in NSW and Victoria, Optus will cover the cost of a replacement card. 

NSW Minister for Customer Service and Digital Government, Victor Dominello, said people with a digital driver licence will have an interim card number "issued instantaneously" via the Service NSW app and a new plastic card will be issued within 10 business days. 

"The cost to replace your driver licence is $29 and will be charged by Service NSW at the time of application – reimbursement advice will be issued by Optus to customers in the coming days," he wrote in a post on Instagram. 

View this post on Instagram

A post shared by Victor Dominello MP (@victordominello)

People in Queensland and South Australia can organise replacement licences free of charge, while the ACT and other jurisdictions are still working through the issue.

Optus also said they will be offering a complimentary 12-month third-party credit and identity monitoring service subscription through their partner, Equifax, for the "most impacted customers". 

If you think your account has been compromised, you can contact Optus on the My Optus App – which they say is the safest way to contact the company, or call 133 937 for consumer customers and 133 343 for business customers.

You can also find the most recent updates from Optus at their media centre here. 

What is the government doing?

Treasurer Jim Chalmers said the government had been "working around the clock" following the breach and has brought together Treasury, the banks and regulators to address privacy and data retention concerns.

"We'll do our best to resolve these issues as soon as we can as part of a suite of broader efforts," he said.

"We want to... make sure that if there's more that can be done by financial institutions to monitor risks and protect consumers, then that should be done."

Health Minister Mark Butler has confirmed the government is also examining whether new Medicare cards will need to be issued to customers.

"We’re particularly concerned that we weren’t notified of the breach of Medicare data until the last 24 hours," Butler told reporters on Wednesday. 

"So, we're working hard to develop strategies for a response to that, as government has been, for example, for some time in relation to passport numbers, as state governments have been in relation to driver's licence numbers."

This article was originally published on September 27, 2022, and was updated on September 28, 2022.

- With AAP. 

Feature Image: Canva/Getty/Instagram@victordominello.