Optus Breach: What Happened And How Akto Can Help?
Learn how Optus, the second-largest telecommunications provider in Australia had API security breach.
Jaydev Ahire
4 min read
As many of us know, the world is in an age of data breaches. We've all heard stories of big companies getting hacked and having their data wiped away. But what happens to these companies if they are caught unaware? Well, Optus had one of those incidents, and it caused a massive data breach that caused some serious issues.
What happened at Optus?
Optus is the second-largest telecommunications provider in Australia. Over 9.8 million customer records were exposed in the Optus data breach on 22nd September. These records included customers' names, physical and email addresses, birth dates, and in some cases, government-issued identification numbers such as driver's licenses and passport numbers. Optus hasn't provided many details up to this point, but there's much to consider.
Optus said that out of its 9.8 million customers, 1.2 million had at least one number from an active and valid form of personal identification information that was exposed in the breach. Optus claimed to have gotten in touch with these clients and advised them to update their IDs. Optus tried to classify the cyberattack as ‘sophisticated,’ but actually, the attack was a ‘basic’ attack Australian Minister for Cybersecurity Clare O'Neil
What caused the massive breach?
As per reports, the API used during testing was unknowingly exposed to the attackers, which was the primary cause of this attack. The API's exposure wasn't only bad enough, the API endpoint didn't have any authentication or authorization mechanism, which means anyone could request the endpoint without any authentication ID or authorization token.
Lastly, the ID number of customers was enumerable like 1,2,3, and so on... Instead of UUID, which is hard to guess. The lack of these basic security precautions cost Optus a massive data breach.
Monthly product updates in your inbox. No spam.
The Highlights:
API used during testing got exposed.
API had no Authentication or Authorization mechanisms.
API had no rate-limiting that allowed attackers to send a large number of requests to retrieve data.
Customer IDs were stored in a weak format instead of the UUID mechanism, which allowed attackers to easily guess and request millions of records.
How to prevent such Data Breaches?
Always maintain an updated inventory of your APIs and know what sensitive data is being passed in request and response.
Keep a check if an unauthenticated API is exposed to the public and sends sensitive data in response. Use a continuous testing and monitoring tool which sends alerts when this happens.
Limit access to your company’s data and allow it on a role-and-needs basis. For example: Even if a supervisor supervises an entire division, he (she) might not require access to all kinds of confidential information.
Use API security tools such as Akto to prevent data breaches. Once you deploy Akto, it will discover all your endpoints, create continuous inventory, and alert if it finds an unauthenticated API exposing sensitive data through continuous testing and monitoring.
Keep reading
Developer best practices
12 mins
Top 34 Cyber security Certifications to Grow Your Career
This guide provides an overview of 34 of the most popular and respected cybersecurity certifications. We have organized them by career stage and specialism, so you can easily find the ones that are most relevant to you.
API security breaches
6 mins
Roku Data Breach - 15000 Customers affected!
Roku revealed a data breach that affected more than 15,000 customers for unauthorized purchases of hardware and streaming subscriptions.
News
5 mins
February Product News: Akto’s Istio Connector, Sensitive Data in URLs and more
This is the February product newsletter for Akto. This month, we launched some exciting features, including Akto’s Istio Traffic Connector, Sensitive Data Detection in URLs and more.