Tangerine hacked: Personal info of 230,000 customers exposed

Tangerine is the latest Aussie telco to suffer a major data breach, after the personal details of 232,000 customers were stolen by hackers. 

Tangerine said in a statement that the hack occurred February 18, with management made aware of the breach on February 20. The telco notified current and former customers by email on February 21 that their personal info had been exposed.

That information included customers’ full names, email and postal addresses and mobile numbers. No credit or debit card information, banking or financial details and passwords were accessed in the hack, Tangerine said. Nor were personal identity documents or numbers, such as passports and driver’s licences, included in the hack.

Tangerine CEO Andrew Branson told customers that no one was more disappointed than him by the breach to the company’s data security.

“As a founder-led organisation, my brother and I put everything we can into the business along with a very talented, committed team,” he said in a statement. 

“Anything that negatively impacts our loyal customer base hurts, and we sincerely apologise to them for this incident.”

Tangerine said it was investigating the breach, which is believed to relate to a single user gaining access to an old customer database. The telco said it had since closed access to the database, revoked all system and network access for the suspected hacker’s credentials and changed all other team usernames and passwords.

The company has also brought in an external cyber specialist and is in contact with the Australian Cyber Security Centre (ACSC) and the Office of the Australian Information Commissioner. 

Mr Branson said that Tangerine had over recent years reviewed what data it needed to keep, which was why driver’s licences, ID documents and credit card numbers weren’t available to the hacker.

 “Moving forward, we are fully committed to learning from this incident and implementing necessary improvements to prevent similar occurrences in the future.”

What should Tangerine customers do about the hack?

Approximately 232,000 people who were Tangerine customers between June 2019 and July 2023 are impacted by the data breach. Some remain current customers of the telco.

Current Tangerine customers have been assured by the telco that their account and access to the Tangerine Self Care Portal is secure. Customers who need to login into the portal or contact Tangerine’s customer support team are protected by multi-factor authentication (MFA). This requires users to enter a temporary code sent to their mobile device before they can access or change their account details.

Tangerine has also provided a list of resources for affected customers, including:

• ID Care: Offers support for individuals impacted by data breaches. 
• Scamwatch: The Australian Government’s national scam reporting and education portal.
• Australian Cyber Security Centre: Assists Australians in protecting themselves online.

Tangerine customers can also find more information at these pages:

• Tangerine’s Online Safety and Cyber Security page
• Tangerine’s Customer Guidance on Scam Phone Calls and SMS
• Tangerine’s ID Authentication for Account Changes and Fraud Awareness

How to keep your accounts safe online

The attack on Tangerine is the latest in a series of telco data breaches, the most notable being the headline-dominating Optus cyberattack in 2022. Telstra accidentally leaked the personal details of more than 132,000 unlisted customers in 2022, and both iiNet and Westnet were hacked in December of the same year. 

If you’re a Tangerine mobile or internet customer – or just looking for tips on keeping your data safe online – consider taking the following additional steps:

1. Regularly change your email, banking, and other important passwords, and enable MFA if available.
2. Never provide passwords or personal details to anyone who asked for them via email or private messages, and avoid clicking on suspicious or unsolicited links or attachments sent to your email or social media accounts. 
3. If you receive a call or SMS from someone claiming to be from a financial institution or other organisation, don’t respond or click on any links – just hang up or block the sender. You can then contact the organisation by its publicly-available number to confirm if the call or text is authentic. 
4. Monitor your bank and credit card statements closely and flag any suspicious activity immediately. You can also place transaction limits on online banking, and set up MFA and other safeguards. 
5. You can ask for a credit report ban if you’re concerned about scammers applying for loans in your name.

Other NBN options

Tangerine offers a range of SIM-only mobile and home internet plans, at highly competitive prices. If you’re a current Tangerine customer weighing up your options, or just want to see how the telco compares to what’s on the market, below is a selection of NBN plans at various speeds from our database.