TPG Telecom's August 2025 disclosure turns iiNet's order management system into the control surface. The company told the ASX that unauthorized access was confirmed on Saturday, August 16, and that it removed the access, engaged external IT and cyber security experts, and began contacting affected and unaffected iiNet customers. The company said the access appeared to be contained to the iiNet order management system and that it had no evidence of impact to broader systems or other customers.
The mechanism is unusually specific. Early investigation pointed to stolen account credentials from one employee, not a publicly disclosed network-wide intrusion. The affected system is used to create and track iiNet service orders, including broadband and NBN connections. That means the data exposure sits in a customer-service workflow: email addresses, landline phone numbers, usernames, residential addresses, phone numbers and modem setup passwords, rather than identity documents, banking records or card data.
That boundary lowers one kind of harm but sharpens another. iiNet and TPG said no passport, driver's licence, credit card, bank account or other financial details were held in the system. But customer contact data, address context and modem setup passwords can still be useful for phishing, scam calls, credential reuse attempts and social engineering that looks locally plausible. iiNet's own customer guidance asks users to stay alert to suspicious emails, texts and calls, use strong unique passwords, enable multi-factor authentication where possible, and reset reused passwords.
The institutional response is part of the signal. iiNet said it liaised with the Australian Cyber Security Centre, the National Office of Cyber Security, the Australian Signals Directorate, the Office of the Australian Information Commissioner and other authorities, and later said it secured an interim injunction prohibiting access, release, use, transmission or publication of affected data.
The next evidence to watch is not another count of exposed addresses; it is whether the final forensic account changes the credential-control story, whether the injunction has practical effect, and whether OAIC or other authorities ask for further remediation.