Optus Data Breach : What Happened And How Akto Can Help?
Learn how Optus, the second-largest telecommunications provider in Australia had API security breach.
Jaydev Ahire
4 min read
As many of us know, the world is in an age of data breaches. We've all heard stories of big companies getting hacked and having their data wiped away. But what happens to these companies if they are caught unaware? Well, Optus had one of those incidents, and it caused a massive data breach that caused some serious issues.
What happened at Optus Data Breach?
Optus is the second-largest telecommunications provider in Australia. Over 9.8 million customer records were exposed in the Optus data breach on 22nd September. These records included customers' names, physical and email addresses, birth dates, and in some cases, government-issued identification numbers such as driver's licenses and passport numbers. Optus hasn't provided many details up to this point, but there's much to consider.
Optus said that out of its 9.8 million customers, 1.2 million had at least one number from an active and valid form of personal identification information that was exposed in the breach. Optus claimed to have gotten in touch with these clients and advised them to update their IDs. Optus tried to classify the cyberattack as ‘sophisticated,’ but actually, the attack was a ‘basic’ attack Australian Minister for Cybersecurity Clare O'Neil
What caused the massive data breach?
As per reports, the API used during testing was unknowingly exposed to the attackers, which was the primary cause of this attack. The API's exposure wasn't only bad enough, the API endpoint didn't have any authentication or authorization mechanism, which means anyone could request the endpoint without any authentication ID or authorization token.
Lastly, the ID number of customers was enumerable like 1,2,3, and so on... Instead of UUID, which is hard to guess. The lack of these basic security precautions cost Optus a massive data breach.
The Highlights:
API used during testing got exposed.
API had no Authentication or Authorization mechanisms.
API had no rate-limiting that allowed attackers to send a large number of requests to retrieve data.
Customer IDs were stored in a weak format instead of the UUID mechanism, which allowed attackers to easily guess and request millions of records.
How to prevent such Data Breaches?
Always maintain an updated inventory of your APIs and know what sensitive data is being passed in request and response.
Keep a check if an unauthenticated API is exposed to the public and sends sensitive data in response. Use a continuous testing and monitoring tool which sends alerts when this happens.
Limit access to your company’s data and allow it on a role-and-needs basis. For example: Even if a supervisor supervises an entire division, he (she) might not require access to all kinds of confidential information.
Use API security tools such as Akto to prevent data breaches. Once you deploy Akto, it will discover all your endpoints, create continuous inventory, and alert if it finds an unauthenticated API exposing sensitive data through continuous testing and monitoring.
Keep reading
API Security
10 minutes
PCI DSS Guidelines
PCI DSS includes a set of rules designed to ensure the safety and security of credit and debit card information, protecting it from data breaches.
Product updates
5 mins
Akto Introduces New Usage-Based Flexible Pricing Model
You can now upgrade your Akto account to our new usage-based pricing model, offering you greater flexibility and value.
API Security
10 minutes
10 Best WAF Solutions
10 best Web Application Firewall (WAF) solutions that filter and monitor web traffic, blocking malicious hackers before they can attack.