19 August 2025
iiNet has been impacted by a cyber incident involving unauthorised access to its order management system by an unknown third party.
The iiNet ordering system is used to create and track orders for iiNet services, such as NBN connections. The system contains limited personal information. Importantly, it does not contain copies or details of customer identity document details (such as passport or driver’s licences), credit card or banking information.
What we are doing
Upon confirmation of this incident on Saturday, 16 August 2025, we enacted our incident response plan, began work to ensure the security of the system and to determine what occurred. We have engaged external IT and cyber security experts to assist with our investigation.
We are making direct contact with affected customers to apologise and inform them of this incident, and to provide support and guidance on what to do next.
We are also liaising with the Australian Cyber Security Centre (ACSC), the National Office of Cyber Security (NOCS), the Office of the Australian Information Commissioner (OAIC) and other relevant authorities in response to this incident.
What personal information has been accessed in this incident?
Based on the current evidence from our forensic experts, it appears a list of email addresses and phone numbers was extracted from the iiNet system. The list contained around 280,000 active iiNet email addresses and around 20,000 active iiNet landline phone numbers, plus inactive email addresses and numbers. In addition, around 10,000 iiNet usernames, street addresses and phone numbers and around 1,700 modem set-up passwords, appear to have been accessed.
What should customers do?
iiNet urges our customers to remain vigilant, especially to any suspicious communications received via email, text or phone call. If in doubt, contact iiNet directly or seek independent advice from trusted sources, including the Australian Cyber Security Centre at cyber.gov.au.
We have set up a dedicated hotline at 1300 861 036 so customers can reach us if they have any concerns.
We will continue to share updates direct with customers, on our website and via the media and our social channels.
Frequently asked questions
What steps can I take to keep my information safe and secure after this incident?
- Be alert to any unusual communications claiming to be from iiNet.
- Reset the passwords for your online accounts where you have used the same password as this incident.
- Always use strong, unique passwords for all your accounts including any financial services accounts and update them regularly.
- Enable multi-factor authentication for your online accounts where possible, including your email, banking, and social media accounts.
- Be cautious of emails or calls asking for personal information or passwords.
- Do not share your personal information with anyone (unless you are confident about who you are sharing it with).
- Ensure you have up-to-date anti-virus software installed on any device you use to access your online accounts.
How do I reset my iiNet password?
You can reset your iiNet password in a few simple steps. We have a password reset support page that walks you through how to create a new password for your iiNet account
What do I need to know about scam calls and phishing emails?
Scam calls, texts and phishing emails are becoming increasingly sophisticated and can appear to come from legitimate email addresses or phone numbers with local area codes. They will often claim to be contacting you from a reputable organisation, such as a government entity, bank, or telecommunications agency. They will also create a sense of urgency to try to get you to disclose sensitive information or to elicit funds from you.
How can I identify a suspicious URL?
- When on a webpage asking for your login credentials, take note of the web address or URL. The URL is located in the address bar of your web browser and typically starts with ‘https://’.
- If you are suspicious of a URL, do not provide your login details. Contact the entity through the usual channels to ensure you are logging into the correct web page.
- Keep in mind: we will never contact you to ask for your username or password.
I’m no longer an iiNet customer. Why was my information compromised?
The incident involved a system that contained historical customer records. While you may not be an iiNet customer anymore, some of your information remained stored due to legal, regulatory, or operational requirements.
How can I contact iiNet for support?
We have set up a dedicated hotline so customers can reach us if they have any concerns.
Call: 1300 861 036
Hours: Monday-Friday 8.30am-8.00pm and Saturday-Sunday 9.00am-5.00pm AEST
More resources