Karmactive Team
A cyber incident at iiNet has compromised contact details of hundreds of thousands of customers after attackers breached the company’s order management system using stolen employee credentials on Saturday.
What happened: TPG Telecom confirmed to the ASX on August 19 that hackers gained access to iiNet’s order system used for tracking NBN connections and other services. The breach was quickly identified and contained, with the company launching an immediate incident response.
“We unreservedly apologise to our iiNet customers impacted by this incident,” TPG stated in their ASX announcement. As part of their response, iiNet has secured an interim injunction prohibiting access or use of the impacted data by third parties.
The Hard Data: What’s Been Exposed
Based on current analysis from forensic experts, it appears a list of data was extracted from the iiNet system. The list contained around 280,000 active iiNet email addresses and around 20,000 active landline numbers, plus inactive email addresses and numbers. Additionally, around 10,000 usernames with associated street addresses and phone numbers, plus roughly 1,700 modem setup passwords, appear to have been accessed.
WHAT WASN’T EXPOSED: No identity documents (passports/licenses), credit card details, or banking information were compromised, as this data wasn’t stored in the affected system.
Early investigations suggest the unauthorized access was gained using stolen account credentials from one employee. This type of credential-based attack has affected multiple telecommunications companies despite growing industry awareness of the risk.
What To Do Now
iiNet has established a dedicated support hotline (1300 861 036) for customers with concerns about the breach.
ACTION BOX: PROTECT YOURSELF TODAY
- Watch for phishing: Be suspicious of any emails, texts or calls claiming to be from iiNet
- Change your passwords: Reset any credentials used across multiple accounts
- Enable MFA: Add multi-factor authentication to email, banking, and social media
- Verify communications: iiNet will never ask for passwords via email/text/phone
- Call for help: Contact iiNet’s dedicated breach hotline at 1300 861 036 if concerned
Similar Posts
The main risk isn’t direct identity theft—it’s falling for follow-up phishing attempts crafted with your legitimate contact details. These attacks typically create false urgency (“your account will be suspended”) combined with convincing iiNet branding to trick you into clicking malicious links or sharing credentials.
Regulatory Response in Motion
The breach has triggered Australia’s Notifiable Data Breaches (NDB) scheme, requiring iiNet to inform affected individuals and the Office of the Australian Information Commissioner when a data breach is likely to result in serious harm.
iiNet is liaising with the Australian Cyber Security Centre (ACSC), the National Office of Cyber Security (NOCS), the Office of the Australian Information Commissioner (OAIC) and other relevant authorities in response to this incident.
Carol Bennett, CEO of the Australian Communications Consumer Action Network (ACCAN), acknowledged TPG’s response, stating: “It is important that communication with customers is fast, accurate, and clear. TPG’s quick response and the information provided to customers is welcome.”
Bennett further advised: “Affected customers should remain alert and take steps to safeguard their personal information. Support is also available from IDCARE, Australia’s national identity and cyber support service, which can provide tailored advice to those who may be at risk.”
Former customers may also receive notifications, as some historical data remained stored due to “legal, regulatory, or operational requirements,” according to iiNet. The company is contacting all affected individuals directly with specific guidance.
The Bigger Picture
This breach highlights why credential hygiene remains critical in our connected world. When one employee’s login falls into the wrong hands, hundreds of thousands of customers can be affected—even when the compromised system contains limited personal data.
The attack demonstrates why cybersecurity pros constantly push multi-factor authentication and password managers. When credentials are your primary security layer, they become high-value targets for attackers looking for the path of least resistance.
For concerned customers, iiNet’s main advice is simple: stay alert, verify before clicking, and contact the company through official channels if you receive suspicious communications.
If you believe you’ve received a phishing message or have questions about the breach, contact iiNet’s dedicated support line at 1300 861 036 or visit cyber.gov.au to report suspicious activity.
