SYDNEY - The cost for Singtel to make up for one of Australia's worst data breaches risks wiping out more than one-quarter of its annual profit.
Optus, Singtel's Australian mobile phone business, last week revealed that hackers had accessed the personal information of as many as 9.8 million customers - over one-third of the population. Some 2.8 million of them lost details of passports, driver's licences or government-issued medical identity cards, triggering concerns about large-scale identity fraud, according to the government.
One week after the hack was disclosed, the scale and the fallout - as well as the potential costs for Optus - are growing.
Prime Minister Anthony Albanese said the company should pay for replacement passports, while Australia's biggest states said Optus would pick up the tab for new driving permits. The government also plans to tighten cyber-security legislation because of the breach.
Cyber attacks have become more common worldwide, exposing at least 11.43 billion customer records at several hundred entities in the space of more than a decade. Australian police are working with the United States Federal Bureau of Investigation on the Optus hack.
Home Affairs and Cyber Security Minister Clare O'Neil on Wednesday described the attack as "a big wake-up call" for corporate Australia.
Mr Ajay Unni, chief executive officer and founder of cyber-security consultancy StickmanCyber, said that the average cost incurred by a hacked company for each customer record lost is US$150 to US$200 (S$216 to S$288).
This includes compensation, legal bills and the cost of public relations campaigns.
"Some organisations end up spending double that," he said.
Applied only to the 2.8 million worst-affected Optus customers, this would equate to between US$420 million and US$560 million. Singtel made a profit of US$1.44 billion in the year ended March.
Optus is also likely to spend money tightening security and on training, according to Mr Unni.
Australian law firm Slater & Gordon is assessing a class action against Optus and says it has received tens of thousands of registrations.
It is difficult to itemise the costs for Optus. It has offered the worst-hit customers a free 12-month subscription to credit monitoring and identity protection service Equifax. This costs A$14.95 (S$14) a month, so if 2.8 million customers accepted the offer, it could notionally cost A$502 million. Of the identity documents exposed, passports are the most expensive, although it is not clear how many have been compromised. A replacement costs A$193.
Optus did not reply to an e-mail seeking comment on the possible costs or the estimate of between $420 million and $560 million. The company has apologised for the data breach. It said late on Wednesday that 36,900 medical identity numbers were among the records exposed.
Ms O'Neil said: "The Australian government should have better powers to enforce cyber-security provisions on private companies and that is something I will be looking to do in the wake of the attack." BLOOMBERG