iiNet hacked: Customers urged to stay vigilant after email addresses, phone numbers hacked

One of Australia’s major internet providers has been hacked.

iiNet revealed on Tuesday that it had been compromised, with an unknown third party accessing its order management system on Saturday.

The company said that most of the data breached was of a non-identifying nature and used to authenticate and activate orders for iiNet services such as NBN.

However, it admitted that a list of email addresses and phone numbers had been extracted from its system.

The list contained about 280,000 active iiNet email addresses and about 20,000 active iiNet landline phone numbers, plus inactive email addresses and numbers.

In addition, about 10,000 iiNet user names, street addresses and phone numbers and about 1700 modem set-up passwords look to have been accessed.

It said no credit card, banking details or customer ID documents (passport or driver’s licence) were hacked because such information was not held in the system.

iiNet said that external IT and cyber security experts had been engaged to determine the full scope of accessed information.

Early investigations suggest the unauthorised access was gained using stolen account credentials from an employee.

“We can confirm no credit, banking or financial information have been compromised,” TPG Telecom chief executive Inaki Berroeta said.

“No driver’s license numbers, ID documentation details or bank account details were disclosed as a result of this incident.

“We unreservedly apologise to the iiNet customers impacted by this incident.

“We are continuing our investigations to ensure we understand all details surrounding this incident.

“We will begin contacting customers to make them aware of the incident, apologise and provide details on the support available.”

iiNet said its teams had been working around the clock to understand the full scope of customer data affected by the breach and how it might impact them.

“We are making direct contact with affected customers to inform them of this incident and to provide support and guidance on what to do next,” the company said.

“We have actively engaged with the Australian Cyber Security Centre, the National Office of Cyber Security, the Australian Signals Directorate, the Office of the Australian Information Commissioner and other relevant authorities in response to this incident.”

Customers are urged to remain vigilant, especially of any communications received via email, text or phone.

If in doubt, contact iiNet directly on 1300 861 036 or seek independent advice from trusted sources including the Australian Cyber Security Centre at cyber.gov.au.

A dedicated information page with updates on the breach and how customers are affected can be found here.

iiNet said it would be in touch with impacted customers, advise of any actions they should take and offer assistance.

iiNet has experienced security breaches in the past, specifically impacting some of their business customers.

In late 2022, TPG Telecom, iiNet’s parent company, revealed that an unauthorised party accessed a hosted exchange service used by iiNet and Westnet, potentially exposing email addresses and other information for about 15,000 customers.

In 2015, iiNet investigated a potential breach affecting more than 30,000 customer passwords.