Optus—Optus data breach exposed 9.5 million Australians' personal and government-ID data; OAIC sued over systemic security failures

A September 2022 cyberattack on Optus exposed personal information of approximately 9.5 million Australians, including names, dates of birth, addresses, phone numbers, email addresses, and government identifiers (passport, driver's licence, Medicare, birth and marriage certificate numbers, and defence/police IDs); some data was later released on the dark web. On August 8, 2025, Australia's Information Commissioner (OAIC) filed civil penalty proceedings in Federal Court against Singtel Optus Pty Limited and Optus Mobile Pty Limited, alleging the company seriously interfered with customers' privacy by failing to take reasonable steps to protect personal information and failing to manage cybersecurity risk commensurate with its size and the volume of sensitive data it held, in breach of the Privacy Act 1988, over the period October 17, 2019 to September 20, 2022. The case remained before the Federal Court as of October 2026, with theoretical maximum exposure (at the pre-2022 penalty rate of A$2.22 million per contravention) running into the billions depending on how contraventions are counted.