Optus and the API anyone could call
Data on up to 9.8 million Australians leaked. Reports point to an API that didn’t check who was asking.
Optus, Australia’s second-largest telco, says personal data on up to 9.8 million current and former customers was taken, including passport and licence numbers for some. Reports say the data came through an internet-facing API that didn’t require any login. Optus disputes how simple it was. Either way, the question for the rest of us is the same.
Do you know every API you expose, and what each one checks?
Common problems I find:
- Test or partner APIs left open after a project ended.
- IDs you can count through: change
/customer/1001to/customer/1002and get someone else. - No rate limits, so one client can download millions of records.
- Returning everything, when the screen needs three fields.
Fixes: an inventory of APIs, authentication on every endpoint, checks that the caller owns the record, rate limits, and alerts on unusual volume. And keep less data, especially ID numbers you don’t need after verifying someone.