Telstra and Big Bank Reveal Data Breach Hit More than 30k Employees

By Isabel McMillan and Eli Green

One of Australia’s big four banks and another telco are dealing with their own cyber breaches just days after the Optus hack.

Telstra and NAB have had the names and email addresses of current and former employees accessed by hackers.

Up to 30,000 names and email addresses of past and present Telstra staff were uploaded to the same forum where the Optus breach was shared last week.

NAB says the data of its employees was accessed through a “third-party provider for an employee and member benefits program”.

“This is not a breach of NAB systems,” an NAB spokesperson said.

“None of our customers’ banking or financial information has been breached or compromised.

“The data released is five years old and is very basic, such as names and emails and we believe there is minimal risk.”

NAB has not had a “direct relationship” with the provider for “a number of years”, the spokesperson said.

A Telstra spokesperson confirmed that it was also the subject of a “third party provider” breach.

“It is not a Telstra data breach, it has nothing to do with our systems or networks.”

“The data contained which is staff names and email addresses is from 2017. It’s six years old.”

Telstra confirmed “It involves our employees, many of which no longer work for the company.”

“We’ve been made aware of a data breach affecting a third party that included limited Telstra employee information from 2017.”

“To be clear, it was not a breach of any Telstra systems. The data released is very basic in nature – limited to full names and email addresses used to sign up to the platform.”

“No customer account information was included. We believe it’s been made available now in an attempt to profit from the Optus breach.”

“The relevant authorities have been notified, we’ve let current employees know, and while the data is of minimal risk to former employees, we will attempt to notify them too.”

There is no private, personal information involved in the leak, as only first and last names and work email addresses of employees was shared.

It is understood that hackers are using a technique called data-scraping where old data is pulled together in the hopes that they can sell it as current data.

Telstra has been dealing with a data breach, where details of 30,000 past and present staff were leaked.

On Saturday, Telstra group executive for transformation, communications and people Alex Badenoch said the data was of a third party which had provided a rewards program for Telstra staff.