Optus Data Breach – The Latest Advice on What You Should do if You’ve Been a Victim

What data was stolen?

According to Optus, the stolen data includes:

·       Names

·       email addresses

·       postal addresses

·       phone numbers

·       dates of birth

·       passport numbers

·       driver’s licence numbers

·       Medicare numbers

Contrary to some reports, passwords and financial information were not stolen.

However, this is a great opportunity for your to do some “spring cleaning” and improve your password and Cybersecurity hygiene.

Firstly, get yourself a password manager, such as LastPass, so you can not only store all your passwords securely, you can use the manager to:

  • Check how secure your passwords are

  • Ensure you’re using unique passwords for every site or service you’re subscribed to

  • Check to see if your email address(es) or commonly used passwords have ever been involved in a known breach. You can also check this at Have I Been Pwned.

DON’T make up your own passwords.

Password managers create random, unique passwords, and let you set the complexity and length.

We recommend:

  • Upper and lowercase characters

  • Numbers

  • Symbols (not all sites allow this)

  • 20 characters (not all sites allow passwords this long)

Set a complex and easy to remember master password for your password manager.

We recommend a sentence with upper and lowercase, numbers and a symbol. E.g. ILoveParisInSpring2022! is a strong password.

For any sites or services, you’ve subscribed to that offer multifactor authentication for your online accounts, turning this on is a must. Only certain sites force multifactor authentication on you, such as financial accounting packages such as Xero and MYOB.

For any others, the best thing to do is to Google “How to turn on multifactor for %INSERT SERVICE HERE%” and you should be able to find an FAQ page for that service explaining how to enable it.

This is your first line of defence!

Now, not all multifactor authentication is created equal. Some are more secure than others. e.g. getting a code sent to your email or sending an SMS to your mobile is not recommended. This is worth a separate post. Watch this space!

However, some sort of MFA is better than nothing.  

What Else Should You Do?

Contact your local Road and Traffic Authority

The New South Wales, Victoria, Queensland, and South Australia governments have started clearing bureaucratic hurdles for anyone who can prove they are victims of the hack.

Each state has different laws and processes, so be sure to check out your local Road and Traffic Authority website for more information.

VIC: Information regarding Optus breach : VicRoads

NSW - https://www.service.nsw.gov.au/optus-breach 

QLD - https://www.qld.gov.au/transport/licensing/update/change-your-customer-reference-number

SA - https://service.sa.gov.au/news?a=1112633

ACT - https://www.accesscanberra.act.gov.au/s/article/Information-about-the-Optus-data-breach

WA - https://www.transport.wa.gov.au/aboutus/37546_48564.asp

TAS - https://www.service.tas.gov.au/services/me-and-my-identity/personal-information-card/impacted-by-the-recent-optus-cyberattack

Medicare

All the customers who have an unexpired Medicare card will be contacted by Optus. There are a further 22,000 expired Medicare card numbers that were exposed, and the holders of those cards will also be contacted directly. It's worth noting that Optus says personal information cannot be accessed using just a Medicare number.

Credit Reporting

Optus is providing one year of free Equifax credit reporting, identify and credit monitoring tool. Contact Optus for a code - then go to https://www.equifax.com.au/optus  

Put a temporary ban on your credit reporting - this will block anyone from applying for credit in your name. Extensions to the ban are possible under certain circumstances, especially if you suspect you’ve been the target of identity theft or Cybercrime. https://www.equifax.com.au/eform/submit/credit-ban   

Banking

Make sure all your financial systems have multi-factor authentication. Surprisingly, and perhaps even shockingly, some banks and financial institutions don't force MFA on you, and some don't even offer it.

Contact your bank and notify them your data has been breached in the Optus breach and ask them to put a note on your file.

How do I replace my passport?

You can replace your passport by:

·       going through Passport replacement portal

·       picking up a form at a participating Australia Post outlet

·       contacting an Australian diplomatic or consular mission

Further Information

If you think you may be affected by the recent Optus data breach, contact Optus Customer service on 133 937Optus Media Centre | Optus

If you need assistance with taking these steps, please visit cyber.gov.au or on 1300 CYBER1 hotline

Be alert for scams referencing the Optus data breach. Learn how to protect yourself from scams by visiting www.scamwatch.gov.au.

If you are concerned that your identity has been compromised or you have been a victim of a scam, contact your bank immediately and call IDCARE on 1800 595 160. 

If your identity has been stolen, you can apply for a Commonwealth Victims' Certificate 

The following websites can help you protect yourself and stay informed:

·      Identity theft | Moneysmart

·      Identity fraud | OAIC

·       Report cybercrime | https://www.cyber.gov.au/acsc/report

·      Australian Cyber Security Centre Homepage | ACSC

·       Office of the Australian Information Commissioner

Complaints

If you wish to make a privacy complaint, If you have been affected by the data breach and wish to make a privacy complaint, you can raise this with Optus

If you are unable to resolve your complaint with Optus, you may wish to lodge a complaint with the Telecommunications Industry Ombudsman. If you are unsatisfied with the outcome, you can lodge a privacy complaint with the Office of the Australian Information Commissioner.

Credit:

The Guardian Optus data breach: everything we know so far about what happened | Optus | The Guardian

Malwarebytes Optus data breach "attacker" says sorry, it was a mistake (malwarebytes.com)

ABC News Impacted by the Optus data breach? Here's how to replace your passport, drivers licence and Medicare card - ABC News

Australian Goverment Optus Data Breach | Australian Passport Office (passports.gov.au)

Australian Businesses Are Being Targeted

This morning the Prime Minister of Australia Scott Morrison called an emergency conference to raise awareness and inform the public of a cyber-attack currently targeting Australian businesses and organisations.

"This activity is targeting Australian organisations across a range of sectors, including all levels of government, industry, political organisations, education, health, essential service providers and operators of other critical infrastructure," he said.

No business is too small to be targeted by this attack

Read More

Incident Response Plan: Why every organisation must have one

Incident Response Plan: Why every organisation must have one

Like we always say, EVERYTHING is hackable. It's not a matter of if, but when.

All businesses are at risk of Cybercrime. All businesses are at risk of a databreach. 89% of businesses worldwide experienced at least one Cybersecurity incident last year. $3.62 million is the average cost of a breach.

This is why Cybersecurity is everyone's responsibility. We may not be able to fully protect our businesses, however, we can do a lot to reduce our risk.

Read More

R.I.P. Windows 7

R.I.P. Windows 7

RIP Windows 7.

Two days ago was the final day of support for Windows 7.

What this means, is that Microsoft is no longer supporting Windows 7.

Without support, there are no more software or security updates being released.

On simple terms, if exploits are found in Windows 7 which a hacker or malware could exploit, your risk is huge.

Read More

Anatomy of an Attack - Inside the mind of a hacker

Have you every wondered what a hacker was thinking when they were planning and then executing their plan to take advantage of your business and information?

This video from Cisco while a couple years old, is still relevant too today’s world with business still being targeted. See what small steps a hacker can go through to get inside your business and turn your day for the worse.