Telstra is rocked by a data breach with hackers gaining access to staff info

Telstra has been rocked by a data breach with hackers gaining access to the personal information of 30,000 current and former staff.

The names and email addresses of the staff members were posted on the same forum the Optus breach data was posted on last week.

Data unveiled included first names, last names and work email addresses of 30,000 Telstra employees who worked for the company prior to 2017.

It also included the information of 12,800 of employees still employed by the telco. 

Telstra’s group executive for transformation, communications and people Alex Badenoch wrote a note to staff on Saturday. 

She said the breach related to a third party programme that had previously provided Telstra’s Worklife NAB rewards program for staff.

‘We understand this may cause some anxiety to our people, particularly in the current climate of heightened awareness around cyber security,’ she said.

‘If you wish to find out more about the breach, or to find out if your email address was exposed, please contact our cyber team.

‘In the meantime, we remind you as always to remain vigilant about any unexpected communications.’

She added that the current rewards programme was unaffected, but all user passwords had been reset to be safe. 

 A Telstra spokesperson told Daily Mail Australia: ‘We’ve been made aware of a data breach affecting a third party that included limited Telstra employee information from 2017.

‘To be clear, it was not a breach of any Telstra systems. The data released is very basic in nature – limited to full names and email addresses used to sign up to the platform.

‘No customer account information was included. We believe it’s been made available now in an attempt to profit from the Optus breach.

‘The relevant authorities have been notified, we’ve let current employees know, and while the data is of minimal risk to former employees, we will attempt to notify them too.

It comes after the massive Optus data hack, with the embattled telco giant on Monday shedding more details on the impact of the breach. 

Optus confirmed that the identification details of 2.1 million current and former customers have been exposed in the hack.

Around 1.2 million customers have had at least one number from a current and valid form of identification, and personal information compromised, including 150,000 from passports and 50,000 from Medicare cards.

Telstra’s group executive for transformation, communications and people Alex Badenoch wrote a note to staff on Saturday explaining the situation

Data unveiled included first names, last names and work email addresses of 30,000 Telstra employees who worked for the company prior to 2017

Optus chief executive Kelly Bayer Rosmarin stated in a new video message that those 1.2 million customers should take action and have already been contacted. 

The remaining 900,000 who had expired IDs compromised, in addition to personal information may also need to action, pending updates from licensing authorities.

Around 7.7million customers haven’t had their personal details stolen and don’t need to take action but are urged to remain vigilant.

Optus has also appointed Deloitte to launch to an independent external review of the cyberattack, and its security systems, controls and processes.

Deloitte will undertake a forensic assessment of the cyberattack and the circumstances surrounding it as Optus vowed to regain customers trust. 

The update came hours after the telco giant sent a general mass text to impacted customers during the NRL grand final on Sunday night, sparking massive outrage.

‘Cyberattack update: Confirming only the license number on your Driver Licence was exposed, not the card number. Your State or Territory government will provide advice on any action that you may need to take via their website,’ the text from Optus read.

Millions of angry Optus customers received this concerning text message on Sunday night

Optus has confirmed the identification details of 2.1 million current and former customers were exposed in the recent cyberattack (pictured an Optus store in Sydney last week)

Almost 10million Australians remain at risk of having private and sensitive information sold online after a hacker infiltrated Optus’ system and raided the details of its current and former customers.

‘While the numbers have come down, we are disappointed that even one customer’s information could be affected,’ Ms Bayer Rosmarin states in the new video.

‘And we are deeply deeply sorry that this could occur, especially because we genuinely care about safeguarding our customers’ information.’

She ended the five minute video by reassuring customers Optus was doing everything it can to ensure no harm comes to customers as a result of the cyberattack.

On Sunday morning federal ministers lined up to give Optus a drubbing.

Attorney-General Mark Dreyfus said he was yet to get an explanation why Optus hoarded sensitive personal information of people even after they left the telco.

The data stolen by the hacker came from 10million current or former Optus customers and dated back to 2017.

Cyber Security and Home Affairs Minister Clare O’Neil said that Optus had not done enough to alert those most at risk, particularly the 10,200 people who had their details leaked online by the hacker.

‘Optus has advised it has told those people – an email is simply not sufficient under these circumstances,’ Ms O’Neil told a media conference.

‘We are going to need to go through a process of directly speaking to those 10,200 individuals.

‘Optus needs to take up the mantle here to directly ensure people are aware when they are directly at risk, as those people are.’

Shara Evans, who is a leading technology futurist, says Optus faces an ‘extinction-level event’ after the mass hack that stole the personal data from up to 10 million of its customers

Attorney-General Mark Dreyfus said Optus hadn’t answered the question as to why it was keeping customer information for so long

She said Optus had failed to provide the government with information on who and how many were at risk.

‘We would like Optus to be transparent about the numbers of people who have had specific identity documents compromised and that information has not yet been provided.’

The criticism was echoed by Services Minister Bill Shorten who said his department had written to Optus on 27 September asking for details on all those whose had Medicare numbers or other Centrelink information stolen, but as yet had no reply.

‘It’s been 11 days since the breach,’ he said.

‘It is most peculiar that we still can’t identify who has had their Medicare information number to be able to get their information.

‘We need this not tomorrow or the next day, we really needed it days ago.’

Ms O’Neill previously called the Optus breach a ‘basic hack’, something Ms Rosmarin denied saying the data had been encrypted and protected by ‘multiple firewalls’.