Thread by @troyhunt

I’ve got a lot of mixed feelings on this: google.com/amp/s/amp.abc.…

Firstly, good stuff re earlier notification. Data such as what was exposed by the #OptusHack is most valuable when it’s freshest because impacted parties aren’t aware and haven’t taken appropriate action.

But banks are only a small part of the picture and arguably, much more damage is done when email and social accounts are compromised. But there’s not the same regulatory controls over them and it’s easier to quantify financial loss rather than privacy loss.

This also seems to be very Australia focused; what about all the breaches of personal data on foreign services (which is most breaches)? How will foreign financial services be notified? I get it, we’re talking Aussie legislation, but it leaves massive blind spots.

We also should ask why Optus needed to acquire *and* retain identity data of this nature in the first place. To get a SIM card? Sure, but then why the long term retention of that data once identity has been established? Was it worth the problem we now have?

That last point in particular is so fundamental and the article does touch on this re metadata retention laws. Here’s a really easy way to think of it: you cannot lose what you do not have. Or, in other words, what are we willing to risk losing?

Meanwhile, we’ve got Optus saying nothing about how this happened whilst data is being spread through a popular hacking forum (not on that scary “dark web” either, just a normal website), and anonymous parties passing how the whole thing went down directly to @Jeremy_Kirk

Optus will never pay a ransom (they’re no more likely to pay $10 than they are the requested $1M), so the data will be monetised then, eventually, spread publicly such that anyone with a web browser can easily grab it all

We don’t have a “fix” for this that achieves anything of significance and right now, we can’t do much more than just wait and see how messed up things get