Telstra faces potential data breach as employee records allegedly put up for sale

Australian telecommunications giant Telstra is under scrutiny after a threat actor claiming to have the data of 47,300 employees listed the information for sale on a popular hacking forum. The alleged attacker, operating under the alias “UnicornLover67,” has not disclosed all the details of the stolen data but has shared samples that appear to include names, email addresses, physical addresses, and potentially other sensitive information.

The threat actor’s listing reportedly also includes unspecified company names, US addresses, and names of mobile phone stores. Cyber Daily investigated the claims and confirmed that some of the data belong to legitimate Telstra employees. However, Telstra has not publicly acknowledged the incident or commented on the claims. Cyber Daily has reached out to the company for further clarification.

This incident follows a notable 2022 data breach involving Telstra, where the information of 130,000 unlisted customers was inadvertently published on Directory Assistance and the online White Pages. At the time, Telstra clarified that the breach was not caused by a cyberattack but by a database misalignment.

The company immediately removed the affected customers’ information from the directory services and initiated an internal investigation. Telstra’s Chief Financial Officer Michael Ackland apologized for the lapse and assured affected customers of support through IDCARE, a cybersecurity and identity support service.

If confirmed, the current data leak could pose significant security and privacy risks for thousands of employees, particularly as the exposed information could be leveraged for phishing attacks, identity theft, or further exploitation.