Australia’s second-largest internet provider, iiNet, has confirmed a significant data breach affecting nearly 280,000 customers.
The breach, discovered on Saturday, August 16, involved unauthorized access to iiNet’s order management system, which stores customer data related to broadband and NBN service orders.
What Happened?
According to iiNet’s parent company TPG Telecom, the breach occurred after a third party stole account credentials from an employee, allowing access to sensitive customer data.
The compromised information includes:
- 280,000 active email addresses
- 20,000 active landline phone numbers
- 10,000 usernames, street addresses, and phone numbers
- 1,700 modem setup passwords
Fortunately, no credit card, banking details, or identity documents (such as passports or driver’s licences) were exposed, as this data is not stored in the affected system.
Response and Support
TPG Telecom has taken swift action by:
- Removing unauthorized access
- Engaging external cybersecurity experts
- Notifying affected customers
- Setting up a dedicated support hotline: 1300 861 036
- Cooperating with federal agencies including the Australian Cyber Security Centre (ACSC) and the Office of the Australian Information Commissioner (OAIC)
A dedicated information page with updates on the breach and how customers are affected can be viewed with this link: Cyber incident involving iiNet customers
What Should Customers Do?
iiNet urges all customers to:
- Reset passwords, especially if reused across accounts
- Enable multi-factor authentication on email, banking, and social media accounts
- Be cautious of phishing emails, texts, or calls
- Avoid sharing personal information unless certain of the recipient’s identity
Transparency & Accountability
While the breach was confirmed on Saturday, customers and shareholders were only notified on Tuesday, August 19, raising concerns about the delay in communication.
TPG Telecom has publicly apologized and committed to keeping customers informed through its website and social channels.
