Optus’s Repeated Failures Signal a Crisis of Accountability

Shuronjit Sumon Biswas: In recent years, Optus has gone from being a major telecom provider to a symbol of systemic risk in one of Australia’s most critical infrastructures. The sequence of cyberattacks, triple-zero (000) outages, privacy breaches, and operational failures is no longer excusable as “bad luck.” It is a warning that Australia’s telecom regulation, corporate governance, and cybersecurity culture all need urgent reform.

A Litany of Incidents

• 2022 Data Breach
  In September 2022, Optus suffered one of Australia’s largest telecom data breaches, exposing personal information — names, dates of birth, addresses, emails, and in some cases passports and Medicare numbers — of millions of customers. Wikipedia+2ABC+2
  The Office of the Australian Information Commissioner (OAIC) has since sued Optus, alleging that the company failed to reasonably protect consumer data. ABC+2The Cyber Express+2
  Investigations revealed that a coding error / access control vulnerability allowed attackers to bypass controls, an issue that stemmed from legacy system flaws and failure to patch known risks. iTnews+2CSO Online+2

• 2023 Nationwide Outage
  On 8 November 2023, Optus experienced a massive network outage glitch affecting internet, cellular, and fixed-line services nationwide. The failure disrupted banking, public services, emergency calls (000), trains, and more. Wikipedia
  The financial and reputational toll was severe: the company’s market value dropped, and a Senate inquiry was launched. Wikipedia+1

• 2025 Triple-Zero (000) Emergency Call Outage
  The most shocking recent event occurred on 18 September 2025 when a firewall upgrade triggered a technical fault that prevented calls to 000 (emergency services) across multiple states for about 13 hours. Wikipedia+4Wikipedia+4ABC+4
  Around 600 emergency calls failed, and at least three deaths have been publicly linked to the outage (including an infant). Wikipedia+4ABC+4Wikipedia+4
  Optus later admitted that “human error” in upgrade procedure steps was partly responsible. 9News
  Critically, opt-in emergency services (like SA Ambulance) did not receive outage alerts in real time despite protocols. The Guardian
  In many cases, regulators say Optus missed at least five warning signs preceding the outage. 9News

Given these repeated breakdowns, any reasonable observer must ask: why is this still happening?

🔍 What’s Going Wrong?

1. A Legacy Infrastructure Burden & Technical Debt
   Much of Optus’s network ecosystem seems built on aging systems, patched over time. The 2022 breach was linked to a dormant domain and outdated access control logic that remained unaddressed for years. ABC+3CSO Online+3iTnews+3
   When such systems run live-critical functions (like firewall rules or emergency call routing), even a small oversight is amplified into crisis.

2. Weak Governance, Oversight, and Accountability
   Despite these known vulnerabilities, leadership appears slow to act. Critics argue that Optus ignored or delayed reforms suggested after prior incidents. SBS+3SBS+3ABC+3
   The fact that recent outages occurred despite earlier fines and warnings suggests deeper systemic lapses in corporate culture.

3. Underinvestment in Resilience & Redundancy
   The fact that a firewall upgrade could disable emergency calling implies insufficient fallback mechanisms or network segmentation. A truly resilient system should ensure zero single point of failure for 000 systems.
   The lack of real-time alerting to emergency services shows gaps in operational integration and compliance. The Guardian

4. Regulatory & Compliance Gaps
   Until recently, Australia’s telecom oversight lacked real teeth. The absence of a dedicated regulator with robust enforcement powers allowed Optus to rely on goodwill and after-the-fact reviews.
   The government is now pushing a “triple-0 custodian” role to monitor telcos’ emergency service reliability. News.com.au+2News.com.au+2

5. Erosion of Public Trust & Market Consequences
   These repeated failures have damaged Optus’s brand deeply: the company’s brand valuation reportedly lost AUD 1.2 billion after the breach and outage saga. 9News
   Customers are defecting to competitors (e.g. Telstra), willing to pay more for perceived reliability. The Guardian+2Reuters+2

🧭 What Must Change — From My Standpoint

• Mandatory Real-Time Outage Reporting: Telcos should be legally mandated to instantly notify regulators and emergency services about any outage affecting 000 calls.

• Strict Penalties & Oversight: The “triple-0 custodian” role must be empowered to issue fines, demand remediation, and oversee internal audits.

• Infrastructure Refactor: Optus must overhaul its backbone architecture — remove legacy code paths, enforce network segmentation, adopt microservices where failure domains are isolated.

• Independent Auditing & Stress Testing: At least annually, a neutral third party should audit core systems and simulate major crisis scenarios (e.g. emergency call failure).

• Leadership Accountability: Executives should bear not just public embarrassment but also tangible consequences (bonuses clawed back, resignations) when failures affect lives.

• Transparent Communication & Customer Compensation: In events of failure, Optus must communicate promptly, Earth-check all affected, and provide relief (e.g. free service, compensation) proactively.

When a telecom company disrupts emergency services, it stops being just “a company with issues”—it becomes a public safety hazard. The recurring pattern of missteps at Optus is no longer a series of unfortunate incidents — it is a systemic failure. Australians deserve a network they can trust with their lives.

If Optus cannot deliver that, regulators must act decisively—and the government must demand more than half-measures.