Tangerine tangerinetelecom.com.au Tangerine data breach: what happened and what to do
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
In February 2024, Australian telco Tangerine reported a breach traced to a legacy customer database. Have I Been Pwned lists 243,462 accounts, with names, emails, phone numbers, addresses, dates of birth and bcrypt password hashes exposed.
View all 13,118 breaches- Breach date
- 18 Feb 2024
- Affected
- 243,462
- Data exposed
- Dates of birth, Email addresses, Names, Passwords, Phone numbers, Physical addresses, Salutations
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Tangerine is an Australian telco. In February 2024 it reported a cyber incident involving a legacy customer database. Have I Been Pwned (HIBP) lists 243,462 accounts, added on 28 February 2024. iTnews reported that Tangerine put the number of customers affected at about 232,000. The company's own media statement says the cause was traced to the login credentials of a single contractor, whose access was revoked.
Sources checked: haveibeenpwned.com, itnews.com.au, tangerine.com.au
Last verified against the official page:
What was exposed
HIBP lists names, email addresses, phone numbers, physical addresses, dates of birth, salutations and bcrypt password hashes. Tangerine says card numbers, driver's licence numbers, ID documents and banking details were not exposed. Its login process uses a one-time password, but it previously used a traditional password.
What it means for you
Name, date of birth, address and phone number together are the details criminals use to impersonate you to a bank or telco, so identity theft is the main risk, along with scam calls and texts.
The company's response
Tangerine closed the affected database, brought in an external cyber specialist and notified the Australian Cyber Security Centre and the Office of the Australian Information Commissioner.
What to do if you were in it
- 1
Expect scam messages
With your name, address, date of birth and phone number out there, scammers can send convincing phishing emails and texts. Don't click links in unexpected messages; go to the company's site yourself.
- 2
Tell your bank and use extra security
Let your bank, telco and other providers know your details were exposed and ask about added security. Scamwatch gives this advice after telco breaches.
- 3
Consider a credit ban
In Australia you can ask the credit reporting bodies for a free credit ban, which Scamwatch describes as lasting 21 days and renewable. Free help is available from IDCARE.
- 4
Change the password and anywhere you reused it
If you used your Tangerine password on any other account, change it there now, and use a different password for each account. A password manager makes that easy.
- 5
Check where else your details have leaked
To see which other breaches include your email or phone, run a free Serus scan.
Frequently asked
Was I affected by the Tangerine breach?
Tangerine contacts affected customers directly. You can also search your email on Have I Been Pwned for the 243,462 accounts listed.
What was exposed in the Tangerine breach?
Names, email addresses, phone numbers, physical addresses, dates of birth and bcrypt password hashes, per HIBP.
Why do numbers differ?
HIBP counts 243,462 accounts. Tangerine and news reports cite about 232,000 customers.
Sources
- Have I Been Pwned: Tangerine
- haveibeenpwned.com/Breach/Tangerine
- itnews.com.au/news/tangerine-telecom-says-customer-data-of-232-000-affected-by-cyber-incident-605337
- tangerine.com.au/news/media-statement-tangerine-cyber-incident
- scamwatch.gov.au/about-us/news-and-alerts/browse-news-and-alerts/optus-data-breach-scams
Something wrong or out of date? Tell us and we'll re-check it.
