‘No money was paid’: Top executives deny secret deal over 2022 Optus ransomware hack
Singtel executives deny payments were made to prevent hackers releasing personal data of millions of Australian customers in 2022.
Executives from Optus’ parent company Singtel have emphatically denied any ransom payments were made to prevent hackers releasing the personal data of millions of Australian customers back in 2022.
Appearing before a senate inquiry on Thursday, the local board members of the Singaporean owned Singtel were grilled about their knowledge of the damaging privacy breach four years ago.
The questioning followed a report in The Nightly that senior government officials who responded to the crisis suspected that the Singapore Telco had secretly agreed to hand over an undisclosed payment to end the damaging standoff.
Sign up to The Nightly's newsletters.
Get the first look at the digital newspaper, curated daily stories and breaking headlines delivered to your inbox.
By continuing you agree to our Terms and Privacy Policy.“I was pretty alarmed when I read this morning. It seems as though someone within the security agencies here in Australia is leaking against you,” Greens Senator Sarah Hanson-Young told the Singtel representatives.
John Arthur, an Australian based independent non-executive director on the Singtel board, told the senate committee that he was confident no money was paid by the company to the cyber criminals.
“The key fact here, Senator, in my opinion, is that no ransomware demand was paid. No money was paid.”
In September 2022, a hacker claimed online that they had private data of around 9.8 million current and former Optus customers and initially demanded $1 million in cryptocurrency or threatened to release records daily.
Later that month the alleged cyber criminal had an apparent change of heart, removing their online posts and claiming they had also deleted the only copy of the stolen Optus data.
Gail Kelly, another independent non-executive director of Singtel’s board and a former banking CEO, told the senate inquiry that the company still didn’t know who was behind the damaging data breach.
“We just don’t know. It’s clearly a question we asked ourselves, but we just don’t know. We don’t know who that was, whether the person who asked for the ransom was the same person who was the hacker or the same set of people.”
Numerous figures from the intelligence community, and inside the Albanese government, have told The Nightly they have long suspected a secret payment was made to resolve the crisis.
“We never had any concrete evidence that Singtel, or the Singaporean government, facilitated a ransom payment — but it was certainly weird and more than curious the way the hackers just suddenly backed off,” one senior government official tells The Nightly.
Figures inside the country’s cyber spy agency, the Australian Signals Directorate, have also privately confirmed that assessment to The Nightly, but stressed they never obtained any substantial proof of a payment.
ASD declined to comment on the matter, but a spokesperson has told The Nightly: “The Australian Government’s advice remains that Australian businesses and organisations should not pay ransoms.”
“When paying a ransom to criminals there is no guarantee you will regain access to your information, or prevent it from being sold or leaked online,” the ASD spokesperson added.
In April 2023 Singapore’s Minister for Communications and Information and Minister-in-charge of Cybersecurity, Josephine Teo, travelled to Australia where she spoke out publicly against the payment of ransoms to criminals online.
