The Optus data breach: a timely reminder of your statutory cyber obligations

The recent cyber-attack on Optus, which resulted in the unauthorised disclosure of the personal information of millions of Australian customers, is a timely reminder to all owners and operators of critical infrastructure and other Australian organisations of their statutory obligations to prevent and report cyber security attacks.

The Optus data breach is the first major cyber security incident since the reforms to expand the scope and powers under the Security of Critical Infrastructure Act 2018 (Cth) (SOCI Act). As a telecommunications carrier, Optus is subject to the SOCI Act. However, as we have summarised previously here and here, the amended SOCI Act now extends beyond telecommunications to most other sectors of the Australian economy including data storage and processing, financial markets and payment systems, food and groceries and electricity and gas.