Tangerine Data Breach

Afternoon all

TL:DR - Tangerine were hacked and all your data is on the dark web… banking and license information was not compromised (as far as they know)

Not sure if anyone else has received this or not but thought i would share, as it seems i am one of those unlucky people. Not here to bag their Internet service as i have used them multiple time and never had any issues but figured this might be the best place to post this for people that are currently with them or are thinking about using them.

So as the title mentions, Tangerine were hacked leaking PII.
Email basically states:

We are writing to let you know that Tangerine has been impacted by a cyber incident that has resulted in the unauthorised disclosure of some of our customer data.
We are contacting you as unfortunately, we believe that some of your personal data was disclosed as a result of this incident and have launched a full investigation to determine the cause. Please note that this incident does not affect the availability or operation of our nbn® or mobile services – they continue to operate as normal and remain safe to use.

The following personal information may have been disclosed as part of this incident:

Full name
Date of Birth
Mobile number
Email address
Postal address
Tangerine account number

We can confirm that no credit or debit card numbers have been compromised, as we do not store this information. No driver’s license numbers, ID documentation details, bank account details or passwords were disclosed as a result of this incident.

It appears the unauthorised disclosure of your personal information occurred on Sunday 18 February 2024 and was first reported to Tangerine management on Tuesday 20 February 2024.

How the incident occurred.

Upon learning of the incident, we immediately began an investigation to determine how this incident occurred. This investigation is ongoing and is being treated with the utmost priority.

We know that the unauthorised disclosure relates to a legacy customer database and has been traced back to the login credentials of a single user engaged by Tangerine on a contract basis.

What Tangerine are doing.
As soon as we learnt of this incident, we took steps to prevent any unauthorised access to our data.
We have taken precautionary steps to fully revoke network and systems access for the individual user’s credentials and we have also changed all other team usernames and passwords. Access to the affected legacy database has also been closed.

We have engaged an external cyber specialist to undertake a full and thorough investigation, and we are in contact with the Australian Cyber Security Centre. We have also notified the Office of the Australian Information Commissioner of this incident.

If you still have a Tangerine account, please be assured that your account, including access to the Tangerine Self Care Portal, is secure.

When you contact our team or try to login to the Portal, we will use a one-time verification code sent to your mobile & email to validate your identity and ensure that you have sufficient authority to access the account.

The following additional protections are also available to you as a Tangerine customer:
you have the option of changing your Tangerine account number.
you have the option of setting up additional security questions on your Tangerine account, and you will need to confirm the answers to these questions when you call us to discuss or make changes to your account or services.
What you should you do.

We wanted to notify you of this incident as it could increase your risk of being exposed scam or phishing attacks - where fraudulent phone calls, SMS or emails are sent to trick individuals into revealing personal information.

There are a few things that you can do to reduce this risk:
be alert to all email communications you receive including any email that claims to come from Tangerine Telecom, or that appears suspicious in any way. If you are unsure whether an email claiming to come from us is legitimate, please contact us directly;
be suspicious of any unexpected requests for your personal information, including your financial information.
Additional ways to protect yourself online.

Setting up multi-factor authentication (MFA) on your online accounts
MFA provides you with an extra layer of protection as it involves using two or more authentication factors to verify your identity, such as information you know (e.g. your personal, account or password details) together with information you have (e.g. a unique code sent to your phone or your fingerprint). While it may be easy for a criminal to steal one form of information (like a password), it's harder for them to steal two.

Regularly change your passwords

We understand that this one is annoying, but the fact is, automated attacks rely on people using the same password for many accounts and therefore if you do not change your passwords regularly (and make it one hard to crack), you could be at risk. If you are someone who finds it hard to keep track of passwords (who isn’t these days?), you might want to consider subscribing to a password manager.

Additional resources.
In addition to the above steps to protect yourself online, here’s some additional resources to help you recognise and report scams.

ID Care – supports individuals impacted by data breaches. Find out more here.
Scamwatch – learn how to recognise, avoid and report scams here.
Australian Cyber Security Centre (ACSC) – find out more ways to protect yourself online here.
Tangerine’s Online Safety & Cyber Security page.
Tangerine’s Customer Guidance on Scam Phone Calls & SMS – find out more here.
Tangerine’s ID Authentication for Account Changes & Fraud Awareness – find out more here.

If you have any further questions or concerns about this incident, you can get in contact with our Customer Service team on 1800 936 147 or by creating a Support Case in the Self Care Portal.

You can also view our media statement here.

I apologise that this incident occurred and for any concern this has raised for you. We will continue to update you during and once our investigation has concluded.

Regards,
Andrew Branson
Chief Executive Officer