What happened
In December 2022 Telstra disclosed that it had inadvertently published the names, addresses and phone numbers of customers who had paid to keep their numbers unlisted, through a database misalignment rather than a cyber attack. Reporting put the number at about 132,000 customers [tel-reuters]; other reporting described it as more than 130,000 [tel-acs].
The communications regulator, the ACMA, later investigated. It found that, in incidents mostly occurring in 2021–2022, 24,005 unlisted numbers were published in the White Pages and 139,402 were made available through directory assistance — more than 163,000 breaches of Telstra’s licence conditions, affecting over 140,000 customers [tel-acma], [tel-acma-report]. Information Age linked the ACMA’s action to the leaks disclosed in December 2022 [tel-acs-2024].
Timeline
- 2022-12 — Telstra disclosed the unlisted-number publication [tel-reuters], [tel-acs].
- 2024-05-02 — ACMA investigation report on Telstra’s carrier licence conditions (White Pages) [tel-acma-report].
- 2024-07 — ACMA announced its findings and issued Telstra a remedial direction [tel-acma], [tel-acs-2024].
Current status
Regulator action taken. The ACMA issued a remedial direction, which stays in force until the audit recommendations are implemented; no penalty was issued [tel-acma], [tel-acs-2024]. This was an internal error, not a hack.
Why it matters
People pay for silent numbers precisely to stay unfindable — often for safety reasons — so publishing them is a real, targeted harm even without an attacker involved.