Giant data hack in Australia risks eating into SingTel’s profit

(Sept 29): The cost for Singapore Telecommunications Ltd to make good customers exposed to one of Australia’s worst data breaches risks wiping out more than one-quarter of its annual profit.

Optus, SingTel’s Australian mobile-phone business, last week revealed hackers accessed the personal information of as many as 9.8 million customers — over one-third of the population. Some 2.8 million of them lost details of passports, drivers licences or government-issued medical identity cards, triggering concerns about large-scale identity fraud, according to the government.

One week after the hack was disclosed, the scale and the fallout — as well as the potential costs for Optus — are growing.

Prime Minister Anthony Albanese said the company should pay for replacement passports, while Australia’s biggest states said Optus would pick up the tab for new driving permits. The government also plans to tighten cybersecurity legislation because of the breach.

Cyberattacks have become more common worldwide, exposing at least 11.43 billion customer records at several hundred entities in the space of more than a decade. Australian police are working with the US Federal Bureau of Investigation on the Optus hack. Home Affairs and Cyber Security Minister Clare O’Neil on Wednesday described the attack as “a big wakeup call” for corporate Australia.

The average cost incurred by a hacked company for each customer record lost is US$150 to US$200, said Ajay Unni, chief executive officer and founder of cybersecurity consultancy StickmanCyber. That includes compensation, legal bills and the cost of public relations campaigns. “Some organisations end up spending double that,” he said.

Applied only to the 2.8 million worst-affected Optus customers, that would equate to between US$420 million and US$560 million. Optus-owner SingTel made a profit of US$1.44 billion in the year ended March.

Optus is also likely to spend money tightening security and on training, according to Unni. At the same time, Australian law firm Slater & Gordon Ltd is assessing a class action against Optus and says it has received tens of thousands of registrations.

It’s difficult to itemise the costs for Optus. It has offered the worst-hit customers a free 12-month subscription to credit monitoring and identity protection service Equifax. That costs A$14.95 a month, so if 2.8 million customers accepted the offer, it could notionally cost A$502 million (US$326 million). Of the identity documents exposed, passports are the most expensive, though it’s not clear how many have been compromised. A replacement costs A$193.

Optus didn’t reply to an email seeking comment on possible costs, or the estimate of between US$420 million and US$560 million. The company has apologised for the data breach. It said late Wednesday that 36,900 medical identity numbers were among the records exposed.

“The Australian government should have better powers to enforce cybersecurity provisions on private companies and that’s something I’ll be looking to do in the wake of the attack,” O’Neil said.