5 Lessons from the Optus Data Breach for Telecom and Third-Party Risk

In September 2022 Optus experienced a major data breach that exposed PII for over 9.5 million customers (including passports, driver licenses, dates of birth, addresses, and contact details) due to a misconfigured, unauthenticated API and a coding error that persisted for years; the attacker used basic tactics such as IP rotation and behavior mimicry to avoid detection, and the report outlines root causes and five CISO takeaways for improved API inventory, secure SDLC, data retention, anomaly detection, and asset discovery.