Optus — Accidental disclosure

Historical
Accidental disclosure
Verified from an official regulator or organisation notice

What this record states

Optus has reported a data breach through an accidental disclosure.

The source states that information about porting customers who requested an unlisted number was involved, across 1 category of personal information.

No source consulted for this record states when it was first publicly disclosed.

People affected: 41,278, stated by the source.

Record overview

Incident date: 1 October 2015
Discovery date: Not confirmed
Disclosure date: Not confirmed
Notification date: October 2019
People affected: 41,278, stated by the source
Who was affected: porting customers who requested an unlisted number

Each date is either established by a quoted source or explicitly not confirmed.

Affected people and data

Categories of affected data

Customer Directory Details

Notifications and response

Regulators notified

Not stated

Law enforcement notified

Not stated

Legal and formal response

Not stated

Technical and organisational remediation

Not stated

Official sources

Official notice

Privacy Commissioner finds against Optus in White Pages breach | OAIC

oaic.gov.auRetrieved 7 August 2026

View official source

Further official sources

Regulatory update

Official publication

oaic.gov.auRetrieved 7 August 2026

View official source

Cleverer commentary

This section is commentary by Cleverer, not reporting, and is not drawn from the sources cited above.

Cleverer Insight

The OAIC determination records that 41,278 porting customers who had asked for an unlisted number remained published in the White Pages between 1 October 2015 and 27 September 2019, and that affected individuals were notified in October 2019. This record does not establish a discovery date, and it does not establish when the matter was first publicly disclosed. Both are marked unknown here rather than inferred from the date the determination itself was published.

What the record shows is a customer preference captured correctly in one place and not carried through to another. An instruction of this kind is only as durable as the reconciliation between the system that accepts it and the system that acts on it, and the determination notes the risk was understood throughout the period rather than identified at the end of it. That makes the verification of a stated privacy preference an evidentiary question as much as a settings question: not whether the option was offered, but whether anything periodically confirmed the outcome matched the instruction.

How Cleverer may have helped

Where a customer privacy preference is captured in one system and acted on by another, Cleverer may help an organisation maintain current evidence of system ownership and responsibility, configuration and control reviews, periodic reconciliation checks between those systems, privacy-control testing, corrective actions, and the staff awareness responsibilities that sit alongside them.

This would not mean the incident was necessarily preventable. It could, however, make it easier to show that a stated privacy preference is being implemented as intended, and to surface a gap between instruction and outcome while it is still a control question rather than a regulatory one.