Optus seriously interfered with the privacy of about 9.5 million Australians in failing to protect their data, and could face hefty fines for each breach in new court action.

The Office of the Australian Information Commissioner has filed Federal Court proceedings against the telco for the September 2022 cyber attack, in which the private data of customers – including home addresses, birth dates, phone numbers and email addresses – found its way to the dark web.

Optus failed to take reasonable steps to protect users’ data, breaching the telco’s obligations under the Privacy Act, chief commissioner Elizabeth Tydd said.

“Organisations hold personal information within legal requirements and based upon trust,” she said.

“The Australian community should have confidence that organisations will act accordingly, and if they don’t the OAIC as regulator will act to secure those rights.”

The action comes after the organisation’s investigation following the attack.

Optus said it would review and consider the matters raised in the proceedings and would respond to the OAIC’s claims in due course.

“Optus apologises again to our customers and the broader community that the 2022 cyber-attack occurred,” a spokesman said on Friday.

“We strive every day to protect our customers’ information and have been working hard to minimise any impact the cyber attack may have had.”

The Federal Court can impose a civil penalty of up to $2.22 million for each contravention of the Act. The OAIC has alleged one breach for each of the about 9.5 million individuals affected.

Imposing the maximum penalty for all victims would be impossible, since Optus’ Singapore-listed owner Singtel has a total market value of about $101.5 billion.

The breach highlighted some of the risks associated with external-facing websites, particularly when they interacted with internal databases holding personal information, Australian Privacy Commissioner Carly Kind said.

“All organisations holding personal information need to ensure they have strong data governance and security practices,” she said.

“These need to be both thorough and embedded, to guard against vulnerabilities that threat actors will be ready to exploit.”

­-AAP