The 2022 Optus breach exposed the personal data of up to 9.8 million customers, roughly 40 percent of Australia’s population, via an unauthenticated API endpoint.
Key facts
- Occurred in 2022 and affected up to 9.8 million customers.
- Caused by an exposed, unauthenticated API endpoint requiring no credentials.
- Exposed identity data including passports and driver licence details for many customers.
- Prompted regulatory action, with the OAIC pursuing the matter.
The lesson
A single unauthenticated API exposed tens of millions of records. The Optus breach is a lesson in securing and inventorying every internet-facing endpoint.
How DarkThreatX helps
DarkThreatX monitors the dark web for breached records, leaked credentials and exposed data tied to your organisation, so you can detect exposure early. Run a free dark web scan or explore the platform.
