CyphrQ
Menu

Optus Data Breach Penalty: The OAIC and ACMA Court Cases Explained

What Optus said about its 2022 cyberattack, what the OAIC and ACMA allege in Federal Court, the penalty limits, and what security teams should check.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

Incident: September 20229 min read

Is there an Optus data breach penalty yet? Not yet. Two Australian regulators have taken Optus to the Federal Court over its 2022 breach. The OAIC (the privacy regulator) alleges failures affecting about 9.5 million people and says the court can impose up to A$2.22 million per contravention. The ACMA (the communications regulator) brings a separate case. As of 25 October 2026, neither page we read reports an outcome.

This is a case file. It separates what Optus and the regulators have said from what a court has decided, which so far is nothing. The closing section turns that into checks for your own organisation.

Case file

Field Value
Organisation Optus (Singtel Optus Pty Limited, Optus Systems Pty Limited, Optus Mobile Pty Ltd)
Region Australia
Breach date The ACMA alleges the breach occurred between 17 and 20 September 2022 (ACMA). The OAIC's alleged contravention period is about 17 October 2019 to 20 September 2022 (OAIC)
Disclosed Optus media release, 22 September 2022 (Optus)
People affected About 9.5 million Australians, per the OAIC's allegation. Optus's 22 September 2022 release gives no count
Data types Names, dates of birth, phone numbers and email addresses; for a subset of customers, addresses and ID document numbers such as driver's licence or passport numbers. Optus said payment details and account passwords were not compromised
Penalty/action OAIC civil penalty proceedings (up to A$2.22 million per contravention); separate ACMA Federal Court proceedings
Regulator OAIC; ACMA
Status Pending. Both regulators describe the matters as before the court

What did Optus say when it disclosed the cyberattack?

On 22 September 2022, Optus said that following a cyberattack it was investigating possible unauthorised access to the information of current and former customers. It said it shut down the attack once it discovered it (Optus).

Optus listed the information that may have been exposed: names, dates of birth, phone numbers and email addresses. For a subset of customers it also listed addresses and ID document numbers, such as driver's licence or passport numbers. It said payment details and account passwords were not compromised, and that mobile, home internet, messaging and call services were not affected.

It said it was working with the Australian Cyber Security Centre, and had notified the Australian Federal Police, the OAIC, other key regulators and key financial institutions. It offered proactive notifications and third-party monitoring to customers it believed to be at heightened risk.

That release is Optus's first account. We have not summarised later Optus statements, because we did not read them.

How many people did the Optus breach affect?

Optus's 22 September 2022 release does not give a customer count. The only figure we can attribute to an official page is the OAIC's: its case concerns "approximately 9.5 million Australians" (OAIC).

That is the regulator's allegation about the people whose privacy was affected, not a figure Optus has confirmed on the page we read. The ACMA statement we read gives no customer count either. Press reports quote other numbers. We have left those out, because a figure belongs here only if we have read it at its source.

What is the OAIC alleging against Optus?

On 8 August 2025 the OAIC announced civil penalty proceedings in the Federal Court against Singtel Optus Pty Limited and Optus Systems Pty Limited (OAIC).

  • The allegation. Optus failed "to take reasonable steps to protect their personal information from misuse, interference and loss", which is a serious interference with privacy under the Privacy Act 1988.
  • The period. From about 17 October 2019 to 20 September 2022.
  • The count. The Commissioner alleges one contravention for each of about 9.5 million individuals.
  • The maximum. "The Federal Court can impose a civil penalty of up to $2.22 million for each contravention." The OAIC notes that the higher penalties introduced in December 2022 do not apply to this case.

We don't multiply those two numbers. They show how the OAIC framed its claim, not what a court will order. Whether a penalty is ordered, and how much, is for the court.

For the same year and the same regulator, see the Medibank case file. That post covers the Medibank breach and does not repeat this one.

What is the ACMA alleging against Optus?

The ACMA is a second, separate regulator with a separate case. It filed Federal Court proceedings against Optus Mobile Pty Ltd. It alleges that during a data breach between 17 and 20 September 2022, Optus failed to protect the confidentiality of customers' personal information from unauthorised interference or access, as the Telecommunications (Interception and Access) Act 1979 (Cth) requires (ACMA).

The ACMA statement says the matter is before the court and the ACMA is making no further statements. The page gives no customer count, no filing date and no penalty figure, so we give none.

Who is asking what? OAIC and ACMA side by side

OAIC ACMA
Law Privacy Act 1988 (APP 11.1: reasonable steps to protect personal information) Telecommunications (Interception and Access) Act 1979 (Cth): protect the confidentiality of customers' information
Defendant Singtel Optus Pty Limited; Optus Systems Pty Limited Optus Mobile Pty Ltd
Period alleged About 17 October 2019 to 20 September 2022 17 to 20 September 2022
Stated penalty limit Up to A$2.22 million per contravention Not stated on the page we read
Status Before the court; no outcome reported Before the court

Is the Optus data breach penalty decided?

Question Status as of 25 October 2026
Did Optus disclose a cyberattack on 22 September 2022? Yes, in its own release
Did Optus fail to take reasonable steps (OAIC) or to protect confidentiality (ACMA)? Pending. Allegations, not findings
Is a penalty coming, and of what size? Pending. The OAIC says this is for the court
Judgment or settlement? None reported on the OAIC or ACMA pages we read

Going deeper: for security and IT teams

What the primary sources don't say. Optus's release says the attack was shut down on discovery. The OAIC and ACMA pages state the allegations at a high level. None of the three pages we read describes the technical attack path. We have therefore not mapped this case to MITRE ATT&CK technique IDs. Doing it from press reports or memory would put guesses into a post that promises read-at-source evidence. The regulators' court filings may describe the path in detail, and we did not read them.

What the allegations do tell you. Both cases turn on a duty to protect, not on one named flaw. The OAIC's alleged contravention window starts in October 2019 and runs to 20 September 2022, nearly three years. The ACMA's alleged window is three days. A control that fails quietly for years is, in the OAIC's framing, a compliance problem as much as an incident.

What "reasonable steps" means in practice. The OAIC's APP 11 guidelines list the factors: the nature of the entity, the amount and sensitivity of the personal information held, the possible adverse consequences for an individual in a breach, the practical implications of the measure, and whether the measure is itself privacy invasive. A carrier holding identity data on millions of people sits at the demanding end of that scale.

The OAIC's guide to securing personal information says reasonable steps include "technical and organisational measures". Its Part B covers nine areas: governance, culture and training; internal practices, procedures and systems; ICT security; access security; third-party providers; data breaches; physical security; destruction and de-identification; standards. The guide names multi-factor authentication, encryption, audit logs, network segmentation, penetration testing and a data breach response plan.

APP 11.2: the retention duty. Once personal information is "no longer needed for any purpose for which the personal information may be used or disclosed", an entity must take reasonable steps to destroy or de-identify it, unless a law or court order requires retention. It matters here because Optus's release lists ID document numbers among the data possibly exposed. The pages we read don't say why any of that data was still held, and we make no claim about it. The control applies to you regardless: data you don't hold can't be exposed.

Controls to test, using the OAIC guide's own headings.

  • Access security. Every internet-facing service that can return personal data should require authentication, with MFA for staff and administrative access. Test by trying to reach each one without credentials.
  • ICT security and testing. Keep an inventory of internet-facing systems and APIs, and include old or secondary ones in penetration tests. The ACMA's allegation that confidentiality was not protected from "unauthorised interference or access" is the failure this control targets.
  • Audit logs and monitoring. Alert on unusual volumes of record retrieval from a single source, not only on failed logins. Check that you retain enough logs to establish exactly what was accessed, because a regulator will ask for a number.
  • Retention. Map where identity documents and their numbers are stored, set a retention period, and test that deletion happens.
  • Breach response. Practise the first 24 hours: who tells the regulators, the banks and the customers. Optus's release shows the list it used: the ACSC, the AFP, the OAIC, key regulators and key financial institutions.

What to verify or ask.

  • Which of our systems could return customer identity data to an unauthenticated request? Prove it with a test, not a policy.
  • How long do we keep ID document numbers after they expire, and where do copies live?
  • Could we state, within days, how many people's data was accessed and which fields?
  • If a regulator pleaded one contravention per affected person, what would our exposure framing look like?

What should you check after the Optus case?

  1. List every service, including old ones, that can return personal data over the internet.
  2. Confirm each one requires authentication, and that admin access uses MFA.
  3. Find every store of ID document numbers and set a retention and deletion rule.
  4. Alert on bulk record retrieval, and confirm your logs can show what was taken.
  5. Rehearse a breach notification: regulators, financial institutions, customers.

Learn more

Key takeaways

  • Optus disclosed a cyberattack on 22 September 2022 and said payment details and account passwords were not compromised.
  • The OAIC alleges failures affecting about 9.5 million Australians, with a maximum civil penalty of A$2.22 million per contravention. The ACMA brings a separate case under a different law.
  • Both are allegations. As of 25 October 2026, the pages we read report no judgment, settlement or penalty.
  • The three official pages we read don't describe the technical attack path, so we haven't guessed one.
  • The practical lesson: know every system that can return personal data, and delete the data you no longer need.

Sources