Skip to main content
company

Optus

Australia's second-largest telecommunications carrier, a subsidiary of Singapore's Singtel. Suffered a major 2022 data breach affecting 9.5 million customers and a fatal 2025 Triple Zero emergency-call outage, both now subject to Australian regulatory civil penalty actions.

Track Record

negligent

A September 18, 2025 Optus network outage, triggered by a botched routine network upgrade, left customers unable to reach Australia's Triple Zero (000) emergency call service for roughly 14 hours; about 75% of 605 Triple Zero call attempts failed during the outage, which was linked to two deaths. A review commissioned by Optus and led by Kerry Schott (released December 2025) found as many as ten compounding mistakes by Optus and contractor Nokia, plus poor risk management, internal audit, and customer/stakeholder communication. On July 30, 2026, Australia's communications regulator ACMA filed Federal Court proceedings against Optus Mobile Pty Limited alleging 1,005 separate occasions on which it failed to provide access to the emergency call service, breaching the Telecommunications (Consumer Protection and Service Standards) Act 1999 and the Telecommunications (Emergency Call Service) Determination 2019. Optus subsidiaries had already paid over A$12 million in ACMA infringement notices after a similar November 2023 Triple Zero failure.

negligent

A September 2022 cyberattack on Optus exposed personal information of approximately 9.5 million Australians, including names, dates of birth, addresses, phone numbers, email addresses, and government identifiers (passport, driver's licence, Medicare, birth and marriage certificate numbers, and defence/police IDs); some data was later released on the dark web. On August 8, 2025, Australia's Information Commissioner (OAIC) filed civil penalty proceedings in Federal Court against Singtel Optus Pty Limited and Optus Mobile Pty Limited, alleging the company seriously interfered with customers' privacy by failing to take reasonable steps to protect personal information and failing to manage cybersecurity risk commensurate with its size and the volume of sensitive data it held, in breach of the Privacy Act 1988, over the period October 17, 2019 to September 20, 2022. The case remained before the Federal Court as of October 2026, with theoretical maximum exposure (at the pre-2022 penalty rate of A$2.22 million per contravention) running into the billions depending on how contraventions are counted.