Optus customers say they are growing increasingly angry and frustrated at the poor communication from their mobile provider over the massive customer data breach that left millions vulnerable to identity fraud.
In the four days since Optus first reported that up to 10 million customers had personal information taken in a data breach, customers have been left scratching their heads over how Optus has communicated with them.
“I have contacted them several times and they could not confirm if my data was part of the attack or not,” one customer said on Monday. “Speaking with them this afternoon, my account is flagged as being compromised. Yet still nothing.”
Another customer who had been with the telco for more than five years said they had already looked to switch providers.
“I attempted to call over the long weekend but couldn’t get through. I spoke to a rep over the chat app yesterday,” Lex said.
“Their chatbot couldn’t understand what I was asking about, which didn’t help things. Once I got through to a rep, they didn’t offer much help.”
Sarah, another customer, said: “The comms have been absolute rubbish and the responses I’ve seen to the online chats less than helpful.”
Others have reported issues with Optus’ chat application, with staff on the other end initially denying the data breach and then offering limited and unhelpful advice.
A chat message said: “While reviewing the account we can see flash notes on the account and we are suspecting that your accounts has been the victim of cyber-attack but I would say nothing to worry about anything here because the moment we get to know that there has been cyberattack … we immediately took action to block the attack.”
One customer, who had been with Optus for more than 10 years told Guardian Australia he didn’t receive an email about the breach until Saturday – two days after it was announced.
“Most of the communications about the breach are being done through the media first,” he said. “It’s not giving me any faith that the company will actually improve their security since it’s all seen through a PR/reputation-fixing lens.”
Others said they were still waiting to hear from Optus.
Optus has said it went to media first to report the breach in order to reach as many people as possible.
Another customer said they were charged increased plan fees the day after Optus revealed the breach
“Ultimately, we are sitting ducks for identity theft, and given that we can’t change our dates of birth, address or names, there isn’t much we can do about it, which is incredibly frustrating,” they said.
In its media response to the breach, Optus first hosted an online call on Friday with the company’s CEO, Kelly Bayer Rosmarin, with questions entered into chat by journalists and read out by Optus staff.
The Australian federal police is investigating after the data was allegedly put up for sale online. On Saturday morning a post appeared on a data market from a user claiming to be in possession of the information obtained from the breach with a demand for $1m in Monero cryptocurrency.
On Monday, Optus put forward its head of corporate affairs, Sally Oelerich, on 2GB radio for an interview with host Chris Smith. The frustrated executive said she too was a victim of the breach, while refusing to go into any detail about how it occurred.
The interview came amid reports the breach was not a sophisticated cyber-attack as claimed but the result of an error that made the data available online.
Smith asked Oelerich if she thought the hacker was “legitimate” and Oelerich replied: “To me? Personally? Or me at Optus?”
She continued: “As someone who’s actually been compromised as well, I’m actually trying to do everything I’ve been advised to protect customers and that includes following advice from the Australian federal police.”
Earlier on Monday Optus would not say whether it would offer free credit monitoring services to customers to ensure any suspicious activity in their name was quickly picked up.
After the home affairs minister, Clare O’Neil, publicly called on Optus to offer the service during parliamentary question time, Optus announced that the “most affected” current and former customers would get access to a 12-month subscription to credit monitoring by Equifax Protect.
O’Neil said the incident was of a scale that Australians should not expect to see from a large telecommunications provider and that reform was needed, noting that such a breach in other jurisdictions would result in fines worth hundreds of millions of dollars.
Optus customers had their names, addresses, phone numbers, email addresses, dates of birth and ID numbers compromised in the breach.
