The Optus hacker published 10,200 customer records on a data-selling forum before claiming to delete the full database after pressure. Security experts agree the deletion cannot be verified. The 10,200 released records are freely accessible and already in use. Victims should take protective action now regardless of the hacker’s statement.
Why You Cannot Verify a Hacker’s Deletion Claim
There is no technical mechanism that allows a third party or anyone else , to confirm that a copy of stolen data no longer exists somewhere in the world.
Data that has been exfiltrated from a company’s servers can be copied instantly and distributed across multiple locations, devices, and people before the original attacker does anything with it. When a threat actor claims to have deleted files, what they’re describing is the action of deleting their own copy. That says nothing about:
- Whether additional copies were made before deletion
- Whether the data was already sold to other criminal actors
- Whether the files were shared in private Telegram channels or criminal forums before the public post
- Whether anyone who downloaded the published 10,200 records kept them locally
As experts from The Conversation put it plainly when this story broke: the hacker’s claim may even be a deliberate strategy to reduce victims’ vigilance , to make people feel safe enough to lower their guard and become easier targets for subsequent attacks using the stolen data.
The 10,200 records that were publicly released are a different matter entirely. Those records are already freely available and circulating. The deletion claim covers only what the attacker says they held. It has no bearing whatsoever on those already-public files.
What the Hacker Likely Gained From the Deletion Claim
Claiming to delete data benefits an attacker in several ways, even if it’s not true.
First, it reduces law enforcement urgency. An active criminal who has just made a public ransom demand and published sensitive records is under maximum scrutiny. Claiming to walk away and delete everything reduces that pressure.
Second, it gives victims false comfort. People who believe their data has been destroyed are less likely to take protective action, monitor their credit, or lock down their identity documents. That passivity makes it easier to run subsequent scams using the stolen information.
Third, it can protect the attacker’s reputation in criminal communities, framing them as someone who follows through on commitments rather than someone recklessly escalating against law enforcement.
None of this is good news for Optus customers. It’s reason to be more cautious, not less.
What Data Was Stolen and What It Enables
Understanding what the Optus breach exposed is essential for knowing what threats to watch for. The stolen records included combinations of:
- Full names
- Dates of birth
- Phone numbers
- Email addresses
- Home addresses
- Driver’s licence numbers
- Passport numbers
- Medicare card numbers
Some records also included parliamentary and defense contact details, which made parts of the dataset particularly sensitive from a national security perspective.
That combination of identity documents creates multiple fraud pathways. These are not simple data points , they’re the building blocks of identity theft, SIM-swapping, account takeover, fraudulent financial product applications, and convincing impersonation scams.
The same type of concern applies in other major Australian data exposures we’ve covered, including the claim of 25 million Medicare files listed on a dark web forum in September 2026. In both cases, the value of the data to criminals doesn’t expire when a hacker says they’re done with it.
The Scams Already Running on Optus Breach Data
The 10,200 leaked records started being used within hours of their publication. Affected customers reported receiving text messages from scammers claiming to have their data and threatening to post it on the dark web unless they paid. This is known as secondary extortion , criminals who didn’t conduct the original breach buying or using the leaked data to run their own fraud campaigns.
Several categories of scam have followed directly from the Optus breach.
Direct ransom texts to breach victims claiming the sender has personal data and will release it unless paid. The payment won’t protect you. The data is already out.
Data recovery scams where fraudsters contact victims offering to remove data from the dark web or recover stolen money for a fee. As we’ve explained in depth on this site, data cannot be deleted from the dark web once it’s circulating. Anyone claiming to be able to do this is lying and attempting a second fraud against an already-victimised person.
Family impersonation scams (“Hi Mum” scams) where detailed personal information from the breach , including address and family member relationships , is used to make fake emergency contact attempts more convincing.
SIM-swapping attempts using stolen identity documents to convince mobile carriers to transfer a victim’s number to an attacker-controlled SIM.
Why Optus Victims Should Still Act Now
Given that the 10,200 publicly released records are in permanent circulation and the remaining data’s deletion is unverifiable, the recommendation is consistent: act as though your data is compromised regardless of what the hacker claimed.
For government ID documents:
Driver’s licence numbers, passport numbers, and Medicare card numbers were all included in the breach. These are harder to replace than passwords , they’re semi-permanent identifiers. The Australian government initially moved to offer replacement documents for verified breach victims. If you were notified by Optus that your data was affected, check whether you’re eligible for a free replacement of your licence or passport through your state’s relevant authority.
For account security:
Use multi-factor authentication on all accounts linked to your Optus email address or phone number. A SIM-swap attack can bypass SMS-based verification, so authenticator apps offer stronger protection.
For monitoring:
Troy Hunt, who operates Have I Been Pwned, declined to add the leaked Optus records to the database during the initial period. However, regularly checking your email addresses against HIBP remains worthwhile for other breaches that may use Optus data as a building block.
For reporting:
If you’ve experienced fraud or identity theft as a result of the Optus breach, contact IDCare , Australia’s national identity and cyber support service , for tailored recovery support. You can report cybercrime through ReportCyber at the Australian Cyber Security Centre.
The broader principle applies across all major breaches: as we cover in our full guide on what to do when your data appears on the dark web, the protective steps you take before fraud happens are vastly more effective than the recovery process after.
The Bigger Lesson This Case Teaches
The Optus breach and the hacker’s deletion claim together illustrate something that’s worth saying directly: a criminal’s word about what they’ve done with your data is not a security guarantee.
Dark web forums exist precisely because they’re environments where trust operates through reputation, not honesty. A threat actor who deletes data after publishing 10,200 records and attracting AFP and FBI attention has not performed an act of good faith. They’ve performed an act of self-preservation.
The correct response for victims is to treat the data as compromised indefinitely, stay alert to the scam categories that follow these breaches, and protect identity documents wherever possible.
Data breaches of this type don’t end when the hacker posts an apology. They end ,insofar as they ever do, when the data ages out of usefulness to criminals. That takes years, not days.
Frequently Asked Questions
Did the Optus hacker actually delete the stolen data?
There’s no way to verify this. The hacker claimed to delete their copy, but this cannot be confirmed by Optus, the AFP, or security researchers. Additional copies may exist.
Are the 10,200 leaked Optus records gone?
No. Those records were publicly published on a data-trading forum and are freely accessible. The deletion claim does not cover them.
Can I check if my data was in the 10,200 leaked records?
Troy Hunt declined to add them to Have I Been Pwned initially. The safest approach is to assume your data may be affected if you received a breach notification from Optus, and act accordingly.
Are scams already happening using the Optus breach data?
Yes. Reports of direct ransom texts, family impersonation scams, and data recovery fraud targeting Optus customers emerged within hours of the initial leak.
Who can I contact for help in Australia?
Contact IDCare (idcare.org) for identity support, and report cybercrime through ReportCyber at the Australian Cyber Security Centre (cyber.gov.au).