Data breaches at Optus, Telstra, Vodafone face Privacy Commissioner probe

Australian information and privacy commissioner Timothy Pilgrim is making enquiries with Optus, Telstra and Vodafone about allegations that personal information of the telco's customers are for sale online.

A Fairfax investigation has revealed that AI Solutions, a security company based in Mumbai, is offering private information from Australian customers for between $350 and $1000.

The information is allegedly coming from people within offshore call centres and AI Solutions could be just one of potentially several companies selling the details of Australian citizens.

"These allegations, and the community response they have generated, are a reminder that Australian customers expect businesses to handle their personal information in line with Australian law no matter where they operate," addressed Information and Privacy Commissioner Pilgrim.

The investigation suggests that there could be other companies in possession of the data.

An Optus spokesperson told CRN: ”Optus takes the protection of customer data and privacy seriously. Employees who handle customer data receive regular training about their information security obligations and how to identify fraudulent behaviour.

"To minimise the risk of fraudulent behaviour, call centre staff are unable to use recording devices, phones, pens or paper at their workstations. Optus also regularly monitors activities of staff working in our call centres. Our call centre operators do not have access to any platforms or systems that would provide visibility of information like the contents of customer phone calls, text messages or emails."

Telstra have been contacted for comment.

Vodafone issued a statement: "We are aware there are individuals who do attempt to illegally access data through various channels from companies and organisations which hold customer information."

The telco also urged people informed of any possible breaches to report to the company.

According to the report, breaches involved data such as date of birth, home address, alternative phone numbers and also billing statements and calling data history.