By Alice Uribe


SYDNEY--Optus has confirmed that 2.1 million customers have had at least one identity document number stolen as a result of a massive cyberattack late last month, with some customers being advised to change their documents.

Optus, one of Australia's largest telecommunications companies and a unit of Singapore Telecommunications Ltd., said Monday that 1.2 million customers have had at least one current, valid form of identification, as well as personal information compromised. These customers have been advised by Optus to change their identification documents.

For the 900,000 customers who have had numbers relating to expired identity documents exposed, in addition to personal information, Optus said it is working with governments and agencies regarding what further steps, if any, these customers should take.

Optus earlier said that the security breach, which occurred late September, may have exposed personal information for as many as 9.8 million customers, including names, dates of birth, healthcare details, drivers licenses and passport numbers.

Optus Chief Executive Kelly Bayer Rosmarin said in a video statement on Monday that the company is "deeply, deeply sorry," that people have had their data compromised.

"We genuinely care about safeguarding our customers' information and we invest millions of dollars and have teams of people whose job it is to prevent something like this from happening," she said.

The company said Monday that 7.7 million customers don't need to take further action, as their exposed information didn't contain valid or current document identification numbers.

"The data contained details such as email address, date of birth or phone numbers. For these customers, it is important to remain vigilant," Optus said.

Ms. Bayer Rosmarin said the company has been working with more than 20 federal, state and territory government agencies and departments to determine the impact to customers since the cyberattack.

"We also had to meticulously reconstruct from logs exactly what information the hackers were able to access, so that any information we provided to customers was accurate and complete," she said.

For the 10,000 customers who had their data leaked onto the web, Ms. Bayer Rosmarin said that Optus is working with the Australian Federal Police.

"To our knowledge there is no other release of the information of the customers that have been exposed," she said.

Optus on Monday said it has hired external consultants to undertake an independent review of the data breach.


Write to Alice Uribe at alice.uribe@wsj.com


(END) Dow Jones Newswires

10-03-22 0437ET