Australian Telco Tangerine Exposes 243,462 Customer Records in Legacy Database Breach
What Happened
In February 2024, Tangerine, an Australian telecommunications provider, suffered a breach of a legacy customer database. The incident exposed 243,462 records containing personal identifiers such as names, dates of birth, email and physical addresses, phone numbers, and password hashes (bcrypt). The breach was first disclosed through the Have I Been Pwned platform.
Why It Matters for Compliance & Audit Readiness
- Highlights the risk of unmanaged legacy systems that sit outside continuous monitoring and control‑assurance scopes.
- Underscores the need for documented evidence that authentication mechanisms (OTP, password hashing) are regularly reviewed and aligned with NIST 800‑63B or equivalent standards.
- Serves as a practical reminder to maintain auditable data‑retention and secure disposal policies, preventing stale, high‑value data from becoming attack surface.
Who Is Affected
- Telecommunications providers that retain legacy customer‑information stores.
- Any organization storing personally identifiable information (PII) alongside authentication credentials.
- Third‑party service providers integrated with the compromised database (e.g., billing, CRM platforms).
Recommended Actions
- Inventory all legacy databases and map them to your continuous control‑assurance program.
- Verify that password storage follows current best‑practice hashing (e.g., Argon2, bcrypt with appropriate cost) and that OTP flows are enforced for all accounts.
- Conduct a gap analysis against data‑retention policies; securely delete or archive data no longer required for business purposes.
- Update incident‑response playbooks to include mandatory disclosure timelines and evidence‑preservation steps.
Technical Notes
- Attack vector: Unauthorized access to a legacy customer database (specific exploitation method not disclosed).
- CVE(s): None reported in the public disclosure.
- Data types exposed: Dates of birth, email addresses, names, passwords (bcrypt hash), phone numbers, physical addresses, salutations.
Source: https://haveibeenpwned.com/api/v3/breach/Tangerine