What happened
In August 2025 TPG Telecom disclosed that its iiNet subsidiary’s order-management system had been accessed using stolen credentials [register-iinet], [itnews-iinet]. TPG said around 280,000 active iiNet email addresses and around 20,000 active landline numbers appear to have been extracted, and that around 10,000 usernames, street addresses and phone numbers and around 1,700 modem set-up passwords appear to have been accessed [itnews-iinet]. The 280,000 figure counts email addresses, not individuals. TPG said no identity documents or card/bank details were held in the system [itnews-iinet].
Timeline
- 2025-08-16 — Incident contained [register-iinet].
- 2025-08-19 — TPG disclosed the unauthorised access to the iiNet order-management system [itnews-iinet].
Current status
Disclosed; the incident was contained and relevant agencies were notified. Figures are as stated by TPG and reported by media. [register-iinet], [itnews-iinet]
Why it matters
Another reminder that a single compromised business system — not the core network — is often all an attacker needs to reach hundreds of thousands of customer records.