EnergyAustralia customer details exposed after Optus and Medibank cyberattacks by hackers
Released: 06:58 EDT, October 21, 2022 | Updated: 11:09 am EDT, Oct. 21, 2022
One of Australia’s largest utilities has become the latest victim in a series of cyberattacks that have exposed the private information of hundreds of customers.
The Chinese company EnergyAustralia announced on Friday evening that the personal data of 323 small business and individual accounts had been hacked.
The breach occurred through its My Account portal, the energy company said in statements on its website and social media accounts.
Accounts contain information such as name, address, email address, utility bills, phone number, and the first six and last three digits of credit cards.
The cyberattack comes after the personal data of 11 million Optus and 1 million Medibank customers were hacked over the past two months.
Chinese company EnergyAustralia said in statements Friday night that the data of 323 small business and residential customers had been exposed in a breach
The breach happened through its My Account portal, EnergyAustralia revealed in statements on its website and social media accounts on Friday (stock image).
The energy giant, which has 1.7 million electricity and gas customers mostly in the eastern states, disclosed the vulnerability in a Facebook post on Friday.
“Unfortunately, in September-October 2022, our My Account portal was the target of a cyber incident that resulted in the disclosure of data from 323 personal and small business customers,” the post reads.
EnergyAustralia tried to reassure its customers that the hack was minimal and that everyone affected had been contacted.
“There is no evidence that the 323 customers’ information was transmitted outside of our systems during the incident,” it said.
‘No other EnergyAustralia systems were affected.’
The accounts were hacked on September 30th and affected customers were contacted by October 2nd.
The energy giant, which has 1.7 million electricity and gas customers mostly in the eastern states, admitted the breach in a Facebook post titled “Keeping your information safe.”
According to EnergyAustralia, identification documents such as driver’s licenses and bank details were not stored in My Account portals (stock image)
EnergyAustralia is now asking customers to create 12-digit passwords that contain a mix of uppercase and lowercase letters, numbers and special characters.
The energy company said identification documents such as driver’s licenses and bank details are not stored in My Account portals.
The electricity giant warned its customers not to be fooled by “phishing” scams and fake emails that try to trick them into clicking on legitimate-looking but fraudulent links.
EnergyAustralia Hacked – Account Alert
The details of 323 EnergyAustralia customers have been exposed in a new MyAccount portal hack.
The company warned customers about the security of their online passwords.
It suggested customers:
Create a password with at least 12 characters and a mix of uppercase and lowercase letters, special characters and numbers Do not use a password that you have used before or for other accounts Do not share your password with anyone
Source: EnergyAustralia
“At first glance, EnergyAustralia’s fake emails may seem convincing. They include our company name, branding logo and colors, and even our View Invoice icon, which will be familiar to our customers who receive eBills.”
A “phish” is a disguised email that attempts to trick you into entering your password on a fake website or into downloading malicious software.
The company’s chief customer officer, Mark Brownfield, apologized for the impact on customers.
“While this incident was limited in terms of the customers affected, we take the security of customer information seriously and have worked hard to put in place additional layers of security to ensure the protection of all customer information,” he said.
EnergyAustralia is owned by China Light and Power Company after being sold by the Australian government for US$1.4 billion in 2011.
Last month, technology futurist and keynote speaker Shara Evans warned that Australia is an easy target for international hackers.
The tech analyst said a particular weakness is Australians’ habit of sending sensitive data in unencrypted emails.
She specifically pointed to healthcare and insurance providers as companies engaging in substandard practices in terms of requiring sensitive customer information.
UNSW Institute for Cyber-Security Director Nigel Phair agreed Australia was vulnerable online and said the threat was only growing.
“We need to get a lot better in Australia when it comes to cybercrime,” he said.
Tech analysts’ top 10 tips for staying safe online
Shara Evans is a technology futurist and online safety expert. Here are their tips to protect yourself from hackers
1. Get basic IT security on devices including antivirus, malware scanner, ransomware scanner, VPN, firewalls.
2. Use different passwords for each website and app. Make them long and complex – uppercase and lowercase letters, numbers, special characters. Store your passwords in an encrypted password vault.
3. Use two-factor authentication whenever possible (ie: when logging into a secure bank portal, you must provide an authentication code that will be sent to you via SMS or email, or a SecureID token number is required).
4. Use multiple email addresses. If you own a domain, you can easily set up an email alias (“forwarding”) that names a specific website or type of activity. If you’re compromised, you can disable an email alias without affecting everything you do. And it helps you identify the source of the leak.
5. Check your credit reports for signs of fraudulent activity — or false information.
6. Sign up for a credit/ID protection plan and set up credit reporting bans if you have reason to believe your ID has been compromised.
7. NEVER click on any text or email hyperlink that you do not absolutely know is legitimate. A lot of people get into trouble this way. You can check a compressed link by copying it and typing it in the SEARCH BAR to see what comes up. If it is malware, a notice may appear. At least check if the source domain looks suspicious, in that case don’t click on it!
8. When uploading sensitive information to a website portal, look out for the lock icon (https) – this means that your data will be encrypted “in transit” when uploaded to the website. Enterprise cybersecurity practices vary greatly.
9. If someone calls you saying they are from Company X – NEVER give them any information unless you know them and are already expecting a call from a specific number or person.
10. NEVER post your date of birth online! If you have it on social media, DELETE it now. Unless you are conducting an official financial transaction, there are very few good reasons for either party to know your real date of birth, let alone store it.
