This was published 3 years ago

Changes to telco rules proposed to protect customers hit by hack

October 6, 2022 - 6.45am

Changes to regulations regarding telcos are planned, after the Optus data leak, to protect customers' information.

The federal government said the move will "better protect Australians," after at least 2.1 million personal identification numbers were been stolen in the massive cyber attack at the end of last month.

The government will recommend changes to the Governor-General, including to allow telcos to better coordinate with banks to prevent fraud, and allow Optus to share "limited information" with Services Australia.

Generic Optus image — Changes to regulations regarding telcos will be made after the Optus data leak to protect customers' information. Eddie Jim

Personal information should also be destroyed when it's no longer needed, it said.

Treasurer Jim Chalmers and Communications Minister Michelle Rowland announced the planned changes.

"These steps that we announce today are all about helping Optus and the financial services sector and the relevant agencies work together more effectively to protect customers affected by the breach," Chalmers, said.

"If there are further steps that need to be taken, we will take them."

The regulations are only in place for 12 months and will be reviewed.

More than a week after suffering one of Australia's biggest ever cyber attacks, Optus is scrambling to fill customers with confidence after a long period of poor communication, as the Government calls for an urgent end to the confusion.This afternoon and evening customers across the country have reported receiving SMS messages relating to the level of data breach they have been exposed to. — A text sent by Optus to a customer. Nine

The changes will allow telecommunications firms to temporarily share information, such as drivers licences, Medicare and passport numbers of affected customers with regulated financial services firms so they can implement "enhanced monitoring and safeguards" for customers affected by the breach, the government said.

Optus will also be able to share identifiers to help Commonwealth, and state and territory agencies to prevent fraud.

"The proposed regulations have been carefully designed with strong privacy and security safeguards to ensure that only limited information can be made available for certain purposes," a government statement said.

"Information can only be used for the sole purposes of preventing or responding to cyber security incidents, fraud, scam activity or identify theft.

"The proposed changes will also allow for increased fraud detection in the broader financial services sector through existing industry mechanisms to report fraudulent transactions, such as fraud information exchanges."