Optus Breach Data Used for Blackmail Texts: The Case

After a big breach, stolen records do not just sit still. In this case, someone took names and numbers from a public leak and used them to threaten people.

By Siddharth ShankarUpdated October 11, 2026

A data breach rarely ends when the breach is over. The records are copied, shared and sometimes used by people who had nothing to do with the original attack. The Optus aftermath is a clear example.

What happened

The AFP's Operation Guardian found that a man in Sydney found 10,200 records that hackers had posted online after the Optus breach. He texted at least 92 Optus customers demanding $2,000 into a nominated bank account, and threatened to use their personal information for other financial crimes if they did not pay.

The AFP says it has no evidence any victim paid. He was arrested on October 6, 2022 and pleaded guilty on November 8, 2022 to two counts of using a telecommunications network with intent to commit a serious offense (blackmail). On February 7, 2023, the Sydney Downing Centre District Court gave him an 18-month community correction order and 100 hours of community service, with a conviction recorded.

How it worked

The scheme was simple. He took names and phone numbers from a published leak and sent each person a personal message. The threat that he could use their information for other crimes made the message feel credible, because it was real data about them.

Nothing sophisticated was involved. The leaked list did most of the work.

What was exposed

The names and phone numbers from the published leak were reused directly to target victims. The AFP release does not describe other data in the 10,200 records, and we do not guess.

How it ended

The outcome is mixed. He was convicted, but did not go to prison, and the breach itself remains a separate matter. The positive is that nobody is known to have paid.

A timeline of the case

The Optus breach happened in September 2022. The man was arrested on October 6, 2022, only weeks later, pleaded guilty on November 8, 2022 and was sentenced on February 7, 2023. That is one of the faster timelines in this series.

The speed was possible because the offender acted locally and used a small, visible set of messages. Cases involving overseas attackers rarely move this quickly.

Key facts at a glance

• Records used: 10,200 posted online after the breach
• Customers texted: at least 92
• Demand: $2,000 per person
• Plea: guilty on November 8, 2022 to two counts of blackmail by telecommunications
• Sentence: 18-month community correction order, 100 hours of community service, conviction recorded
• Payments: the AFP has no evidence any victim paid

Why this case matters

It shows the second wave of harm from a breach. The original attackers may be far away, but the data they leave behind can be picked up by someone nearby who thinks it is worth trying. The more widely a leak is shared, the more people may try to exploit it.

It also shows why advice about not paying matters. A threat that quotes your information is frightening, but quoting a leaked list is not evidence that the sender can do more.

What you can do

What a "community correction order" means

A community correction order is a sentence served in the community instead of in prison, with conditions. In this case it ran for 18 months and included 100 hours of community service. A conviction was recorded.

Readers sometimes expect jail for blackmail. The court's choice of a community-based sentence reflects its assessment of the particular facts, which the release does not detail. We therefore do not comment on whether it was lenient or fair.

What the release does not say

The release does not give the data fields in the leaked records beyond what was used and does not describe the original attackers. For a Canadian example of leaked records being used, see the Desjardins insider breach.

Nothing here can be undone for the people involved, but you can prepare. See the guides on what to do if your phone number was in a breach, how scammers find your phone number and email and what an exposed phone number means. You can also try our free phone number exposure check.