You may see an increase in targeted phishing attempts via email, text messaging or telephone calls, where the scammer uses details specific to you. Never click on links in emails or text messages, no matter how legitimate they appear. Do not be pressured to respond, whether it is by email, text message or telephone. Instead, contact the organisation sending the message directly using contact details you know to be correct.

Protect your accounts with multifactor authentication, including financial, government, email, and social media accounts.

Use unique and strong passwords.

Contact your telecommunications provider/s (other than Optus), utilities providers, superannuation and financial organisations and request additional security is placed on your account.

Install antivirus on your devices.  This will not prevent all phishing attempts or links to fraudulent websites, but will reduce the risks. You will still need to remain vigilant.

It is always a good idea to regularly review your account details and security settings for any online accounts.  Check that your contact details are correct, and changes have not been made to any linked bank accounts or other services.

Get your free credit reports

• Your credit reports provide a means to assess whether someone has attempted to obtain credit in your name. It is important to obtain your credit report from all three agencies as some may gather credit information others have missed. If you have credentials, including addresses, for both New Zealand and Australia, then you should check your credit reports for both countries.

• In Australia, you can obtain a free credit report every three months, or more often if you have been refused credit within the last 90 days, or your credit-related personal information has been corrected. To apply for your credit reports from Equifax, illion and Experian, please see IDCARE’s Fact Sheet on Credit Reports Australia.

• In New Zealand, there are no limitations to how frequently you can request your free credit reports.  To apply for your credit reports from Equifax, illion and Centrix, please see IDCARE’s Fact Sheet on Credit Reports New Zealand.

 

Apply for a Credit Ban with Equifax, illion and Experian (Australia)

We recommend applying for Credit Bans with all three Australian Credit Reporting Agencies.

• Equifax
• illion
• Experian

Note that you can arrange a ban across all three Credit Reporting Agencies through one application with one of the individual agencies. You can find out more in IDCARE’s Fact Sheet on Credit Bans Australia.

A credit ban “freezes” access to your credit file, meaning that the Credit Reporting Agency is not able to disclose any personal information from your file to credit providers without your written consent, or if they are required to do so by law.

 

 

A ban on your credit file does not impact your current credit line or credit payments unless credit is due for renewal (e.g. credit card about to expire). You will still be able to use any credit cards you currently hold and repay any existing loans. 

However, you will not be able to apply for credit while the ban is in place unless you arrange with the credit provider to temporarily lift the ban.

To temporarily lift the ban in Australia

• Experian - complete the online ban lift request form
• Equifax - call 13 83 32
• illion - call 1300 734 806 or email pac.austral@illion.com.au

 

Apply for a Suppression with Equifax, illion and Centrix (New Zealand)

If you have New Zealand credentials or have a credit history in New Zealand, we recommend applying for credit suppressions with all three New Zealand Credit Reporting Agencies.

• Equifax
• illion
• Centrix

Note that you can arrange a suppression across all three Credit Reporting Agencies through one application with one of the individual agencies.  You can find out more in IDCARE's Fact Sheet on Credit Suppressions New Zealand.

A credit suppression “freezes” access to your credit file, meaning that the Credit Reporting Agency is not able to disclose any personal information from your file to credit providers without your written consent, or if they are required to do so by law.

A suppression on your credit file does not impact your current credit line or credit payments unless credit is due for renewal (e.g. credit card about to expire). You will still be able to use any credit cards you currently hold and repay any existing loans. 

However, you will not be able to apply for credit while the ban is in place unless you arrange with the credit provider to temporarily lift the ban.

To temporarily lift the ban in New Zealand

·         Equifax – call 0800 698 332

·         Centrix – call 0800 236 874

·         illion – use the same form as your credit suppression request, but select ‘release request’

Potential Risks

Individually, these are both low risk identity attributes, however in combination with other attributes (such as address and phone number) scammers engaging you may appear more legitimate.

 

Recommendations

You may see an increase in targeted phishing attempts via email, text messaging or telephone calls, where the scammer uses details specific to you (such as your name and date of birth for “verification”). Never click on links in emails or text messages, no matter how legitimate they appear. Do not be pressured to respond, whether it is by email, text message or telephone. Instead, contact the organisation sending the message directly using contact details you know to be correct.

Keep being scam vigilant and stay across the latest scams by regularly visiting idcare.org, connecting with our social media, and subscribing to our free online newsletter Cyber Sushi. Another great resource is Scamwatch that collate a wealth of scam information and provide alerting services to our community.

Potential Risks

You may see an increase in email phishing attempts, particularly from scammers claiming to be from Optus. These emails may include malicious attachments, links to fake websites or may download malware onto your device. They may encourage you to update or verify your details or to access a reimbursement via a link. IDCARE has already received reports from individuals who have received phishing emails purporting to be from Optus.

There is also the risk that your email address may be “spoofed” so that it appears to the recipients that the email came from you. If you used a business email to engage with Optus (eg. johnsmith@businessname.com), there is the potential for a scammer to spoof that email address, and attempt to engage with the business to change your personal details, such as your bank account details for your pay.

 

Recommendations

Keep being super vigilant about scams and phishing emails. Having a little bit of information exposed (such as your full name, date of birth, email address or phone number) can make the job of scammers much easier when convincing people about their deception.

Beware of phishing emails, including those asking to update billing details, pay invoices or apply for reimbursements.

Never click on links in unsolicited or unexpected emails, no matter how legitimate they appear.

Do not be pressured to respond to emails. Instead, contact the organisation directly using contact details you know to be correct.

Use an up-to-date antivirus application that includes email protection and scanning.

Advise your place of employment that you have been affected by the Optus data breach, and that you would like additional security measures to be put in place before any changes are made to your personal details (including email, address, phone number, banking and superannuation details).

Attribute

This could be your mobile or a landline/home phone number (Optus should have details on the exact number/s exposed).

 

Potential Risks

The exposure of a phone number can leave you open to being targeted by spam or scam phone calls.

These can appear to be from legitimate phone numbers with local area codes.

They often claim to be an authority or organisation, such as the police, a telecommunication company or a government entity.

The scam-caller may frame the call with a sense of urgency, either in order to avoid a penalty (such as a payment or fine) or to receive a reward (such as a discount).

IDCARE clients have reported receiving calls claiming to be from Optus offering discounts due to the data breach, and requesting additional information about the individual’s driver licence (including the card number).

IDCARE has also received reports from clients who provided remote access to their devices following calls claiming to be from a cybersecurity centre. They were advised that remote access was necessary due to their information being exposed through the Optus data breach.

Scammers may also send fraudulent SMS messages to the phone number. These may impersonate a legitimate organisation and include a link to a malicious download or scam website.

 

Recommendations

Keep being super vigilant about scams, particularly telephone and SMS scams. Having a little bit of information exposed (such as your full name, address, date of birth, or phone number) can make the job of scammers much easier when convincing people about their deception.

Do not feel pressured to respond to a call or text message. If you think a call may be legitimate, hang up and call the organisation back using details that you know are correct.  Do not accept that it is the real organisation because the Caller ID shows their correct number or name – these can be “spoofed” or masked to appear to be teal.

Do not download apps or software (such as AnyDesk or TeamViewer), follow technology instructions, or allow remote access to your device to someone who has called you.

Do not click on links in text messages. Instead, contact the organisation using details you know are correct.

Attribute

The physical address will be the one associated with your Optus account.

 

Potential Risks

For most individuals, physical addresses are considered low risk identity attributes. However, in combination with other attributes (such as your full name, date of birth, email address and phone number) scammers engaging you via email, SMS or telephone may appear more legitimate.

Reports made to IDCARE of cyber criminals physically attending the address are very low. 

You may have additional concerns regarding the exposure of your address if you are a survivor of domestic violence, due to your employment, or for other reasons. If you are in immediate danger, contact the police (in Australia call 000, in New Zealand call 111).

If you are considering increasing your security, be sure to engage a recognised member of the Australian Security Industry Association Limited (ASIAL) or the New Zealand Security Association (NZSA).

 

Recommendations

You may see an increase in targeted phishing attempts via email, text messaging or telephone calls, where the scammer uses details specific to you, such as your full name, date of birth and address.

Do not interact with or engage with callers or emails claiming legitimacy because they know your address.

Never click on links in emails or text messages, no matter how legitimate they appear.

Do not be pressured to respond, whether it is by email, text message or by telephone. Instead, contact the organisation directly using contact details you know to be correct.

Attribute

For some individuals, this data breach event included the Medicare number used when creating their Optus account.

 

Risks

Your Medicare card number may be used as a form of identity verification in order to create accounts in your name, including financial accounts.

Services Australia has advised that your Medicare account cannot be accessed with only your Medicare card number.

Your Medicare card number in combination with full contact details, driver licence and/or passport number can place you at higher risk of misuse, such as access to or creation of financial/credit/loan accounts.

 

Recommendations

Before requesting a new Medicare card, confirm with Optus that your Medicare card number was compromised.

If you’re concerned or you’ve been affected, visit Services Australia’s website for ‘what to do if you’ve been affected by the recent Optus data breach’. If you need further assistance, please call Medicare on 132 011.

Please note that Services Australia is currently advising that your Medicare card needs only to be replaced. The new card will have the same number, except for the final digit. This can be done online following the advice in the link above. 

IDCARE recommends that if you believe that the exposure of your Medicare card number presents a broader risk to other accounts (such as financial accounts), then you may wish to apply for a completely new card number using the Services Australia MS011 form. More information on this process can be found online at Services Australia. When completing the form, you will need to select “transfer to a new card”, and have everybody who is listed on your current Medicare card complete their details if they also wish to transfer to a new card number.

myGov Impersonation Scam

IDCARE is aware of a myGov impersonation text message scam requesting you to update your details.

Don’t click on the link! Always contact organisations independently via verified means. Australian Government agencies will never send you a link to login pages via SMS or email. Emails with hyperlinks will only be sent to your myGov inbox, not your personal email account.

If you clicked the link in an SMS or email, contact myGov immediately via:

• myGov Scams and Identity Theft Help Desk - 1800 941 126 Monday to Friday 8am to 5pm AEST.
• and refer to https://www.servicesaustralia.gov.au/what-to-do-if-scam-has-affected-you?context=60271

IDCARE also recommends logging in to your myGov account to check across all linked accounts:

• your contact details, including email address and phone number, remain unchanged;
• multi factor authentication is enabled;
• your linked services, such as the ATO or Centrelink, remain unchanged. 

Attribute

For some individuals the data breach event included the passport number used when creating their Optus account.

 

Potential Risks

The exposure of a Passport number can leave you open to SIM (Subscriber Identity Module) swaps.

Unauthorised access to financial accounts can occur where the Passport number is used as a form of verification.

New financial accounts (debit accounts, credit cards, personal loans) can be created and this can extend to By-Now-Pay-Later (BNPL) products.

When a scammer has your Passport details, they can create social media accounts in your name and take over existing accounts. They may also establish new utility accounts and apply for rental properties. 

 

Recommendations

Attribute:

For some individuals the data breach event included the driver licence number used when creating their Optus account.

 

Potential Risks:

The exposure of a Driver Licence number can leave you open to SIM (Subscriber Identity Module) swaps.

Unauthorised access to financial accounts can occur where the Driver Licence is used as a form of verification.

New financial accounts (debit accounts, credit cards, personal loans) can be created and this can extend to By-Now-Pay-Later (BNPL) products.

When a scammer has your Driver Licence details they can create Social media accounts in your name and takeover existing accounts.

Services Australia have advised that your myGov account cannot be accessed with only your driver licence number and details. 

IDCARE advises that your driver licence number in combination with full contact details can place your identity at higher risk of misuse. This could occur through criminal activity such as:

• attempting access to accounts via impersonation
• account access facilitated by SIM Swap
• changing details to your online accounts
• establishing new utility accounts and
• applying for rental properties in your name.

 

Recommendations:

The States and Territory driver licence issuers have updated the processes and costs for the reissue of drivers licences for those impacted by the Optus data breach.

Check your relevant State and Territory issuer for most recent advice:

View advice for ACT here

View advice for NSW here

View advice for QLD here

View advice for SA here

View advice for TAS here

View advice for WA here

View advice for VIC here

View advice for NT here

 

 

Attribute

For some individuals, this data breach event included the Proof of Age number used when creating their Optus account.

 

Risk

The exposure of a Proof of Age number can leave you open to an unauthorised SIM Swap.

Unauthorised access to financial accounts can occur where the Proof of Age is used as a form of verification.

New financial accounts (debit accounts, credit cards, personal loans) can be created and this can extend to By-Now-Pay-Later (BNPL) products.

Services Australia have advised that your MyGov account cannot be accessed with only your Proof of Age number or card details.

 IDCARE advises that your Proof of Age number in combination with full contact details can place your identity at higher risk of misuse. This could occur through criminal activity such as:

• attempting access to accounts via impersonation
• changing details to your online accounts
• establishing new utility accounts and
• applying for rental properties in your name.

 

 

For some individuals, this data breach event included the Australian Business Number or Australian Company Number used when creating their Optus account.

Risk

As ABNs and ACNs are publicly available information, additional risk to you from the Optus data breach is low.

However, IDCARE has received reports of cancelled ABNs being fraudulently reactivated and registered for GST. These instances have occurred both before and after the Optus data breach notification, but the risk may have increased due to the information exposed.

Recommendation

You can check the status of your ABN on the free public Australian Business Register ABN Lookup. You can also login to your Australian Taxation Office (ATO) account, select My profile from the Menu, and then Personal details.

If you see that your ABN has been reactivated, or that there is an ABN listed that you did not apply for, contact the ATO Client Identity Support Centre on 1800 467 033 between 8am and 6pm AEST (Monday to Friday).  As well as correcting the status of your ABN, enquire about any additional security that can be placed on your account and consider enrolling your voice on their system.

For all holders of ABNs and ACNs, regardless of its status, you can also check whether Australian websites are using your ABN/ACN details by completing a Registry Search Request Form with auDA.