If the claims by this Twitter user are legit, Optus have seriously failed to meet very basic security obligations.
The API used to access the stolen data was open, meaning authentication wasn't required, and the sequential customer ID records made it easy to enumerate through results. Seriously, an open API that returned highly sensitive personal data by a simple sequential value. Utterly nuts.
A privacy policy means absolutely nothing if this is Optus' idea of security. Again, if the information is correct Optus have left themselves wide own for prosecution.
We've written about APIs that were left exposed in the same way (one revealing personal and medical records of toddlers). We've also discussed numerous instances where mortgage clients had personal data (sourced from offshore processing) auctioned off on the dark web.
