Optus has moved to restrict speculation regarding the magnitude of any fine it could potentially incur as a result of a Federal Court proceeding linked to its 2022 data breach.
In a statement to the SGX [pdf] released on Friday, Optus also mentioned its intention to challenge the quantity of potential violations of data protection regulations with which it has been charged.
The Australian Communications and Media Authority (ACMA) lodged a legal action against Optus last month, claiming that the telecommunications company failed to fulfill its duties in “safeguarding the privacy of its customers’ personal details from unauthorized tampering or access”.
The submission to the SGX reveals that the ACMA has accused Optus of “3.6 million infractions” of Australian legislation; however, Optus asserts that it is only “aware of roughly 10,200 customers whose personal information was exposed online due to the cyberattack”.
The figure of 10,200 pertains to an initial disclosure of a subset of purloined data that was leaked as part of a ransom demand.
Optus indicated that efforts to monitor potential misuse of this leaked data have been ongoing and that it has “undertaken significant measures … to minimize potential harm to customers affected by this breach.”
With regard to the fines that could result from the lawsuit, Optus aimed to play down some of the rough estimates – ranging from billions to trillions of dollars – that have been speculated upon by various media outlets since the lawsuit was initiated.
The telecommunications company mentioned that the question of fines ultimately rests with the Federal Court, although it pointed out that any levy “is not simply a direct computation based on the number of offenses” multiplied by the maximum penalty per offense.
About Author
