Optus on Wednesday wrote to Victorian victims of its data breach whose driver’s licence details have been exposed, telling them they need to register with the state’s roads authority.
The embattled telco also wrote to New South Wales licence holders on Wednesday, telling them that although their licence numbers had been exposed they did not need to apply for new permits because the state uses a dual number system that adds an additional layer of protection against identity theft.
The company has also provided the commonwealth government agency Services Australia with details of Medicare and Centrelink cards – number, expiry date and name – as well as customer dates of birth, home addresses and telephone numbers.
Services Australia will match the data against Medicare and Centrelink records “to identify affected customers and apply proactive security measures to affected customer records”, a data matching program notification gazetted on Wednesday shows.
Optus has yet to provide specific information about what to do next to victims who used Queensland driver’s licences or a passport to sign up for an account with the company.
At least 2.1m Optus account holders had at least one form of ID exposed in the breach, with at least 150,000 passport and 50,000 Medicare numbers stolen.
In the email to Victorians whose licence details were exposed in Australia’s biggest data breach, Optus said that “during further analysis as part of our ongoing investigation, we can confirm that the licence number on your driver licence was exposed”.
“Please note, a copy of your Photo ID was not exposed,” Optus said in the email.
It asked victims to visit the VicRoads website and “report that your driver licence has been exposed by filling out the online form on their dedicated Optus Cyberattack page”.
It said it was “doing all we can to protect you and our customers”, including by notifying government agencies and the Australian Cyber Security Centre, and again apologised for the breach.
One Optus customer who received the email on Wednesday said it was baffling that it was taking the company so long to provide specific information.
“Two weeks in, it’s like, what’s taking them so long?” the customer said. “Surely they would know exactly what was compromised and what wasn’t.”
Optus began warning NSW customers whose driver’s licence numbers had been exposed over the weekend.
On Wednesday, it wrote to them again, saying that “NSW uses a national document verification service (DVS) that means both your driver license and card number are required to verify your identity”.
“Therefore, NSW Gov advises you do not need to replace your driver license.”
An Optus spokesperson said the company was “in the process of contacting customers who have been directly impacted”.
“We will contact customers in writing via email and/or SMS,” the spokesperson said.
“We will not send links or request information, like passwords, in the communications we send our customers about the cyberattack. If we did not have valid contact details for impacted customers, those customers will be contacted via post using the last mailing address we have on file, as soon as possible.
“The information which may have been exposed includes customers’ names, dates of birth, phone numbers, email addresses, and, for a subset of customers, addresses, ID document numbers such as driver’s licence or passport numbers. Customers affected will be notified directly of the specific information compromised.”
In a data matching plan published on its website, Services Australia said that it would “apply proactive security measures” to customer records it identified as exposed in the Optus breach.
It warned this could result in suspension or cancellation of payments.
“Suspension or cancellation activities would only occur where a customer account has been hijacked and action is required to protect the customer’s identity and/or government outlays,” the agency said.
