TPG Telecom 旗下 iiNet 遭遇网络攻击

Sources

Public references used for this article.

• TPG Telecom ASX announcement on iiNet cyber incident — TPG Telecom told the ASX on August 19, 2025 that an unknown third party gained unauthorized access to an iiNet order management system, apparently using stolen credentials from one employee, and that around 280,000 active iiNet email addresses, 20,000 active landline numbers, 10,000 usernames with street addresses and phone numbers, and about 1,700 modem setup passwords appeared to have been accessed or extracted. (source risk: low)
• iiNet customer update on cyber incident — iiNet's customer update says the order management system was used for service orders such as NBN connections, that no identity document, credit card or banking details were held in the system, that impacted customers were contacted, and that iiNet secured an interim injunction against access, release, use, transmission or publication of affected data. (source risk: low)
• iiNet media statement on cyber incident — iiNet's August 19, 2025 media statement supports the incident confirmation date, containment action, stolen-credential pathway, data categories, customer support plan and engagement with ACSC, NOCS, ASD, OAIC and other authorities. (source risk: low)
• TPG Telecom official brand portfolio — TPG Telecom says it operates leading mobile and internet brands including Vodafone, TPG, iiNet, Internode, Lebara and felix in the Australian telecommunications market. (source risk: low)
• OAIC notifiable data breach guidance — OAIC explains that under Australia's Notifiable Data Breaches scheme, covered organizations must notify individuals and OAIC if a data breach is likely to cause serious harm, and that notifications should identify the organization, data types, breach description and recommended response steps. (source risk: low)
• Australian Cyber Security Centre protect yourself guidance — Cyber.gov.au, the Australian Government cyber security portal, provides account, device, email, scam, Wi-Fi/router and reporting guidance relevant to customer protection after an incident involving email addresses, phone numbers and setup passwords. (source risk: low)
• SBS/AAP report on iiNet cyber attack — SBS/AAP independently reported the affected data categories, stolen-credential pathway, delayed public notification sequence, regulator engagement and TPG's statement that there was no evidence of broader system impact. (source risk: medium)
• iTWire report on TPG iiNet breach — iTWire reported TPG's disclosure as a data breach affecting about 280,000 iiNet customers, summarizing the order management system role, stolen employee credential pathway, affected data and regulatory engagement. (source risk: medium)