Optus data breach class action: eligibility and how to join

What happened in the Optus breach

Optus disclosed in late September 2022 that an unauthorised party had accessed customer data across current and former accounts. Reported exposure varied by customer and included names, dates of birth, email addresses, phone numbers and residential addresses, and for many customers identity document numbers — driver licence, passport and Medicare numbers. The scale of the identity-document exposure is what set the incident apart: replacing those documents imposed real cost and time on ordinary customers, and many reported a surge of scam calls and phishing attempts afterwards.

The breach prompted regulatory scrutiny and civil proceedings arguing that Optus, as the holder of that information, owed customers a duty to keep it secure and to destroy or de-identify data it no longer needed. Those are the allegations at the heart of the class action; they remain matters for the court.

Who is eligible

• You were a current or former Optus customer whose personal information was held by Optus at the time of the 2022 breach.
• Your data was among the information exposed — commonly name, date of birth, contact details, and in many cases identity document numbers.
• You suffered loss or inconvenience as a result: replacing documents, monitoring or freezing credit, time spent resolving fraud risk, out-of-pocket costs, or distress.
• You are within the group definition set by the court — the authoritative version is published by the law firm running the proceeding, and it can be amended as the case progresses.

You do not need to have lost money to be a group member. Many Australian data breach claims include people whose information was exposed and who bore the burden of responding to that risk.

How to join the Optus class action

1. 1. Confirm you fit the group. Check the published group definition against your Optus account history and any breach notification you received.
2. 2. Register free with the law firm. Because the proceeding is opt-out you are likely already included, but registering is how you are counted, contacted and made eligible for a settlement scheme.
3. 3. Collect your evidence. Breach notifications, proof you were a customer, receipts for replacement documents, and records of scams or fraud attempts.
4. 4. Track the deadlines. Settlement schemes usually impose a claim cut-off. Re-check the case page rather than assuming you will be contacted.

Our free eligibility check compares your answers against the verified group definitions of the Optus matter and every other open Australian class action we track, and the $9 full report includes the current registration link for each case that matches.

Optus class action FAQ

Am I eligible for the Optus data breach class action?

Generally you may be covered if you were a current or former Optus customer whose personal information was held by Optus at the time of the September 2022 cyberattack — including customers whose name, date of birth, email, phone number, address, or identity document numbers such as passport, licence or Medicare details were exposed. The court sets the exact group definition, so check it against the law firm's published criteria before relying on it.

How do I join the Optus class action?

Australian class actions are usually opt-out, so if you fit the group definition you are typically included without doing anything. To be counted and kept informed you should register free with the law firm running the proceeding. Registration does not commit you to legal costs and you do not need to pay anyone to join.

Does it cost anything to join the Optus class action?

No. Registering is free and class actions are typically run on a no-win, no-fee basis, often with a litigation funder. If the case succeeds, legal costs and any funder commission are deducted from the settlement with court approval. Ordinary group members are not asked to pay legal fees up front.

How much compensation could Optus customers receive?

There is no verified per-person figure while the case is on foot, and anyone quoting a guaranteed payout should be treated with caution. Claims in Australian data breach cases typically cover out-of-pocket losses such as replacing identity documents, time and cost spent dealing with the fallout, and in some cases distress. Your individual share would depend on the settlement, the number of registered group members, and the harm you can evidence.

What happened in the Optus data breach?

In late September 2022 Optus disclosed a cyberattack that exposed the personal information of millions of current and former customers. Depending on the account, exposed data included names, dates of birth, phone numbers, email and residential addresses, and identity document numbers including driver licence, passport and Medicare numbers. The incident triggered regulatory investigations and class action proceedings alleging Optus failed to protect customer data adequately.

I already got compensation from Optus for a new licence — can I still claim?

Possibly. Reimbursement for replacing an identity document does not necessarily extinguish a claim for other loss, but it can affect what you are entitled to and it is a question for the law firm running the case or your own lawyer. Keep records of anything Optus reimbursed you for.

Is there a deadline to register for the Optus class action?

Registration windows and settlement claim deadlines open and close during a case, and missing a scheme deadline can exclude you from payment even if you were in the group. That is why it is worth registering early and re-checking the law firm's case page periodically.

What evidence should I keep for an Optus claim?

Keep the breach notification email or SMS from Optus, evidence you were an Optus customer during the relevant period, receipts for replacing identity documents, records of any fraud or scam attempts that followed, and notes of time you spent resolving the issue.