by
October 21, 2022
As many of us know, the world is in an age of data breaches. We've all heard stories of big companies getting hacked and having their data wiped away. But what happens to these companies if they are caught unaware? Well, Optus had one of those incidents, and it caused a massive data breach that caused some serious issues.
Optus is the second-largest telecommunications provider in Australia. Over 9.8 million customer records were exposed in the Optus data breach on 22nd September. These records included customers' names, physical and email addresses, birth dates, and in some cases, government-issued identification numbers such as driver's licenses and passport numbers. Optus hasn't provided many details up to this point, but there's much to consider.
As per reports, the API used during testing was unknowingly exposed to the attackers, which was the primary cause of this attack. The API's exposure wasn't only bad enough, the API endpoint didn't have any authentication or authorization mechanism, which means anyone could request the endpoint without any authentication ID or authorization token.
Lastly, the ID number of customers was enumerable like 1,2,3, and so on... Instead of UUID, which is hard to guess. The lack of these basic security precautions cost Optus a massive data breach.