Add Category
The Australian Federal Police are monitoring the dark web and internet forums after reports stolen Optus data may be being sold online.
Key points:
- A post on an internet forum claims to be selling details taken in the Optus data breach
- The dataset has not be verified by Optus or authorities
- It is an offence to buy stolen credentials online with a penalty of up to 10 years' imprisonment
One post on the website BreachForums claims to be selling the data, which includes email addresses, dates of birth, first and last names, phone numbers, drivers' license and passport numbers.
The dataset referred to has not been confirmed or verified by Optus, the police, or intelligence agencies, but some numbers have been verified by journalists.
"The AFP is aware of reports alleging stolen Optus customer data and credentials may be being sold through a number of forums, including the dark web," a police spokesperson told the ABC.
"The AFP is using specialist capability to monitor the dark web and other technologies and will not hesitate to take action against those who are breaking the law."
Co-founder of cybersecurity firm Internet2.0, Robert Potter, who has advised US and Australian governments on cyber attacks, said the data was authentic.
"I'm comfortable saying the data is authentic information and an amount of it include email addresses not previously seen in other breaches," Mr Potter told the ABC.
"Some of the data is still encrypted. Optus should confirm if it is from their systems."
It is an offence to buy stolen credentials online with a penalty of up to 10 years' imprisonment.
During a media briefing on Friday, Optus chief executive Kelly Bayer Rosmarin said the company was aware of reports Optus data was allegedly being sold online.
"One of the challenges when you go public with this sort of information is you can have lots of people claiming lots of things," Ms Bayer Rosmarin said.
"There is nothing that has been validated and for sale that we are aware of, but the teams are looking into every possibility."
On Saturday, Optus was not willing to comment on the post citing advice from police.
"We are coordinating with the AFP because this is now a criminal investigation," the spokesperson said.
"Given the investigation, Optus will not comment on the legitimacy of customer data claimed to be held by third parties and urges all customers to exercise caution in their online transactions and dealings.
"Once again, we apologise."
Optus continues to contact customers implicated in attack
Some cyber experts are urging caution around reports of data being sold online, warning it could be an attempt to capitalise on media attention.
Optus is continuing to contact all customers implicated in the cyber-attack.
"We will begin with customers whose ID document number may have been compromised, all of whom will be notified by today," the spokesperson said.
Optus has also advised customers to be very vigilant online and to be careful of scams.
"If customers receive an email or SMS with a link claiming to be from Optus, they are advised that this is not a communication from Optus. Please do not click on any links," the spokesperson said.
"We have been advised that our announcement of the attack is likely to trigger a number of claims and scams from criminals."