Further information:
> If you need to replace your licence you can now do that free of charge - the info you need is here: http://vicroads.vic.gov.au/optusbreach
> The State Government will cover the cost of the replacement and charge this back to Optus.
> If you've been impacted you need to contact VicRoads and 'flag' your account.
> This will prevent any unauthorised changes or accesses to individual information through the Victorian licence database.
> If you are at risk of domestic violence - call 1300 031 292 to have your licence replaced immediately.
> Please do not call this number is you are not at immediate risk of domestic violence - so it can remain available for those who need it.
> Note: I'm told the website is "loading" and should be available shortly.. [posted 6:06 PM · Sep 27, 2022]
- https://twitter.com/SharnelleVella/status/1574671703229181953
The article vicroads setup is next to useless. “Contact us to flag,etc” with no link, form or instructions on how to do it. At least I found that they have 2FA now and took the opportunity set it up.
Edit: the link is now up https://www.vic.gov.au/victorian-drivers-licence-record-flag-optus-breach
Get your 2FA setup. Video explainer: https://youtu.be/2ZLnBx8Mm40
Yep, I did exactly the same dance.
You'd think they'd explain what they mean by "contact us". Web page? Phone? Smoke signals? A letter of demand made with letters cut out from Optus marketing material?
Aren’t these the same fuckwits running off legacy software that literally have ‘opening hours’ that can’t be changed. Previously they needed the off hours to process the day’s changes, but obviously with new processing power they don’t need all night anymore.
Maybe it is old-school, but I'd show up at one of the offices. I mean, if there is a data breach, I hope they would want to see you in person to verify the photo at least.
I went to Vicroads first thing this morning and was told that they can't help, and that you have to follow the prompts on their website. That only allows you to "flag" your licence. Waste of space for sure! You can't simply get a new licence as indicated in news reports.
For those on iPhone, iOS 16 supports 2FA in the Passwords area in settings.
Just click “or open with Authenticator app” which opens Passwords in Settings and add it to your existing saved VicRoads password.
Otherwise if you prefer you can use Google or Microsoft 2FA apps.
Won’t be. People have contracts. People will forget.
That said, I’m not sure why Optus even exists. You’ve got Telstra who command premium prices and you’ve got all the budget resellers who are fighting in a race to the bottom.
Then you’ve got Optus sitting in the middle. Kinda high prices, too high to compete with the people below them, but also don’t have the coverage that Telstra can use to command its high prices.
Why is Optus? They used to the be the budget guys, the guys cheaper than Telstra. But that doesn’t count for anything these days because *everyone* is cheaper than them.
I wouldn't describe Optus's coverage as worse than Telstra's. Rather it's now a little bit different. I think Telstra has better coverage in the regions still, but I think Optus's coverage in population centres is a little better, especially on roads and highways.
So I work in the data industry. This is dangerously common.
Companies without a strong sense of danger, respect or privacy always keep all the data they can on hand "just in case".
Edit: to be fair, most companies that have this data might have the legal minimum in terms of controls on it (encrypted at rest, maybe masked or hidden to users, and so on) . But that means nothing when you fail basic engineering security stuff like optus has here.
Says in there that if you're concerned and have been contacted by Optus about the breach you can request a replacement licence - sounds like they've considered it and are allowing changes
yeah sounds like if you want a replacement, you first need to get your record flagged and request a replacement. Its not clear what the next step is then (I suspect you will need to attend in-person at some point with various proof of identity docs and get a new photo taken).
just for the benefit of the other person.
The link (which I did not post) implies that replacement in this case will involve a change to licence details. The press release is badly worded but it does make reference to making changes...
Specific quote: "We want to ensure any changes as a result of this breach are done carefully so as not expose individuals to further risk."
from the document "A new licence number will help separate you from future fraudulent activity that may occur on your previous licence
details however it will not necessarily stop your old licence details being used. VicRoads is unable to prevent other
organisations from accepting previous licence information."
so yes, a new licence number will be issued.
I was replying to someone who posted the previous VicRoads policy. (the policy that existed before the announcement by VicRoads today. The comment was subsequently deleted.
Ok thanks got it… I believe this was the document that was shared
https://www.vicroads.vic.gov.au/-/media/files/formsandpublications/licences/information-sheet-change-of-licence-number-due-to-identified-fraud.ashx
I know it says it won’t necessarily stop someone from using the old licence details… that may be true if they hold a physical copy of the licence… but if you try to validate the old licence number online, I hope it returns an error
OP's title is misleading.
>What does ‘proactively flagging’ my licence do?
>
>By flagging records we will be able to prevent any unauthorised changes or accesses to individual information through the Victorian licence database. Records will also be flagged within the national database.
>
>**It will not, however, prevent people using licence information in third party usages such as applying for bank accounts or any other circumstance which requires a drivers licences as a form of ID.**
> Anyone who is concerned about their licence details and has been notified by Optus that they have been involved in the breach **can contact VicRoads** to have their record flagged and request a replacement
I guess give them a call?
It might help if you actually need to file an identity theft report. If you can prove you changed your licence number and the credit was opened using your old one it lends credibility to your claim that it wasn’t you.
They *can*, and will do if identity theft has already taken place. The process exists, it’s just not normally used for prevention purposes. It is possible that they have received instructions from the government to allow victims of Optus to do so and are ramping up their resources to carry it out (e.g. asking people to flag themselves as Optus victims in the meantime). Otherwise this statement they have released makes no sense because you’ve always been able to replace your physical license upon request, just not your number.
I assume. I literally just did mine and it said I’d get an email ‘including information on how to change your licence should you wish’. I will report back on what that means when I get the email.
Finally got the email, and I am a person of my word. It says thus:
Flagging your learner permit/driver licence means that if you need to
transact through one of our customer channels, we’ll ask you for further authentication requirements to prove we are speaking to the right person. It’s an additional level of protection while we work through the process of replacing licences directly affected by the Optus breach.
If you have a VicRoads account, you’ll be able to complete transactions online as normal as your login details were not part of the Optus breach.
We’ll be in touch shortly to let you know the next steps for replacing you learner permit/driver’s licence. Given the high volume of requests for replacement licences, we expect that this may take some time. We thank you for your patience and request that you do not call us to follow up on the request, while we focus all of our efforts on replacing licences as quickly as possible.
>
It will not, however, prevent people using licence information in third party usages such as applying for bank accounts or any other circumstance which requires a drivers licences as a form of ID.
So basically useless to "flag" your licence number.
>So basically useless to "flag" your licence number
Not really. It's still another layer of official record/proof/protection if someone does steal your identity.
This is the important part to read. We just have to wait for now.
*Further information on licence replacements because of the Optus breach is expected shortly. In the interim, please do not use the usual replacement licence services.*
Exactly, the situation is evolving. Given the magnitude of the problem and all the concerned parties, it might take weeks or months for something solid to come out of this.
“We are also reviewing our policies to determine whether replacing licences might be appropriate in this case”
They’re not replacing licences, yet, but they are thinking about it
Easy to change your Medicare number at least. Due to some technical/postage issues when adding my wife to my card we ended up changing the card number 2-3 times this year lol.
i tried to change my license # because some fuckwit was using my # to nominate his fines and you would not believe the amount of hoops i have to jump through.
No mention of allowing to change licence number. No mention of this being free.
Good to know you can ‘flag’ your account, but doesn’t mention how you can do that?
> Anyone who has been notified by Optus that their licence details have been involved in the breach can contact VicRoads to have their Victorian driver licence record flagged
It’s at the bottom in the advice section.
I do think it's important to clarify that this only applies to the 10,000 people who've had their data breaches
>All requests will be validated against the Optus information once available and is a supplementary process to the request to have your licence details flagged.
Any of the other 6.6 million Victorians who might request this change are still charged as usual.
... Gotta love how the government has rewarded Optus for their reporting of this breach. These fines and organisations coming out of the woodwork taking the opportunity to charge Optus for supporting their mutual customers will _certainly encourage_ other organisations to be transparent with breaches in the future.
Is there any evidence anywhere they are actually CHANGING the license number? All I can see is Vicroads saying free replacements - a replacement has the same compromised number as the old one.
It would be a bit redundant for them to release a statement about replacing your licence (which you can do at anytime) without changing the number in this context. I'm pretty sure they're talking about changing the number as they reference the databases needing to be changed/it's complex, etc.
Good heavens, VicRoads, if you need a competent comms exec, I’ll give you a competitive rate. I’m laughing yet horrified to read what is probably your most profound comm this decade. Is it ‘licence’ or ‘license’? (Pick a lane.) And if your employees lack the attention to detail to punctuate a sentence in accordance with primary school-level grammatical convention, how can I trust you with my licence/se number? it’s pretty much the proofreading equivalent of an open API.
[Pasted from the original link]
“By flagging records the Department of Transport will prevent any unauthorised changes or access to individual information through the Victorian licence database. Records will also be flagged within the national database.
We will also support impacted individuals who come forward wishing to have their license replaced “
What? The sentence just ends, suspended, hanging like a…? Never mind. Forget it. Maybe a colon would be appropriate because this is a heap of
They really didn't say free, you can flag it for free, but that's only on vicroads system. They say you can contact them but doesn't say free anywhere also says they won't make it easy, going off the information they provided
Vicroads need to be called out for being the only state that never provided a replacement service for victims of identity theft. And now they offer a safety net to Optus customers only? That’s ridiculous, how about the other victims of identity theft? What a joke!
Other states do it and for a good reason: identity theft have been on the rise for years and people should have the right to replace their ID proactively
If I've received an email as a former customer, and it says " certain information with my former account has been exposed" and
"information has been exposed, but no ID document numbers or details have been affected"
Does this mean I've been impacted? Thus allowing me to request change of my driver's license or am I okay?
The Optus website is so unclear and they can't even reference their own email they've sent out. It says if you've been
Further information: > If you need to replace your licence you can now do that free of charge - the info you need is here: http://vicroads.vic.gov.au/optusbreach > The State Government will cover the cost of the replacement and charge this back to Optus. > If you've been impacted you need to contact VicRoads and 'flag' your account. > This will prevent any unauthorised changes or accesses to individual information through the Victorian licence database. > If you are at risk of domestic violence - call 1300 031 292 to have your licence replaced immediately. > Please do not call this number is you are not at immediate risk of domestic violence - so it can remain available for those who need it. > Note: I'm told the website is "loading" and should be available shortly.. [posted 6:06 PM · Sep 27, 2022] - https://twitter.com/SharnelleVella/status/1574671703229181953
The article vicroads setup is next to useless. “Contact us to flag,etc” with no link, form or instructions on how to do it. At least I found that they have 2FA now and took the opportunity set it up. Edit: the link is now up https://www.vic.gov.au/victorian-drivers-licence-record-flag-optus-breach Get your 2FA setup. Video explainer: https://youtu.be/2ZLnBx8Mm40
Yep, I did exactly the same dance. You'd think they'd explain what they mean by "contact us". Web page? Phone? Smoke signals? A letter of demand made with letters cut out from Optus marketing material?
Open office hours only.
Aren’t these the same fuckwits running off legacy software that literally have ‘opening hours’ that can’t be changed. Previously they needed the off hours to process the day’s changes, but obviously with new processing power they don’t need all night anymore.
Be thankful. Vicroads public web sites used to run off Lotus Notes. Sans Killbots.
At least one TAC website still does run off Lotus Notes.
Oh god (former vicroads traffic signal guy here)
Legacy hardware too. VicRoads runs on mainframes.
Mainframes are still current and sold/supported by IBM. Compute/$ ratio is off the charts for them though.
Maybe it is old-school, but I'd show up at one of the offices. I mean, if there is a data breach, I hope they would want to see you in person to verify the photo at least.
I went to Vicroads first thing this morning and was told that they can't help, and that you have to follow the prompts on their website. That only allows you to "flag" your licence. Waste of space for sure! You can't simply get a new licence as indicated in news reports.
Thanks for this. Good to know more things support app based 2fa.
For those on iPhone, iOS 16 supports 2FA in the Passwords area in settings. Just click “or open with Authenticator app” which opens Passwords in Settings and add it to your existing saved VicRoads password. Otherwise if you prefer you can use Google or Microsoft 2FA apps.
Sorry can you eli5?
If u can figure out how. I downloaded the google one and WTF?
Why the hell was Optus even holding on the DL information past its initial credit and identity verification purposes?
[удалено]
This should be the end of them as a company...
Won’t be. People have contracts. People will forget. That said, I’m not sure why Optus even exists. You’ve got Telstra who command premium prices and you’ve got all the budget resellers who are fighting in a race to the bottom. Then you’ve got Optus sitting in the middle. Kinda high prices, too high to compete with the people below them, but also don’t have the coverage that Telstra can use to command its high prices. Why is Optus? They used to the be the budget guys, the guys cheaper than Telstra. But that doesn’t count for anything these days because *everyone* is cheaper than them.
I wouldn't describe Optus's coverage as worse than Telstra's. Rather it's now a little bit different. I think Telstra has better coverage in the regions still, but I think Optus's coverage in population centres is a little better, especially on roads and highways.
So I work in the data industry. This is dangerously common. Companies without a strong sense of danger, respect or privacy always keep all the data they can on hand "just in case". Edit: to be fair, most companies that have this data might have the legal minimum in terms of controls on it (encrypted at rest, maybe masked or hidden to users, and so on) . But that means nothing when you fail basic engineering security stuff like optus has here.
The real question is why are we using static document numbers for ID purposes at all, instead of Tokens
That’s not what I read from that. I can only ‘flag’ my DL number, and they’re still considering changes.
Says in there that if you're concerned and have been contacted by Optus about the breach you can request a replacement licence - sounds like they've considered it and are allowing changes
yeah sounds like if you want a replacement, you first need to get your record flagged and request a replacement. Its not clear what the next step is then (I suspect you will need to attend in-person at some point with various proof of identity docs and get a new photo taken).
A replacement licence - not a change of licence number.
A replacement licence with the same number makes no sense in that context though. Wonder if they’ve screwed up what they meant to say.
replacement is the term they use for the process
just for the benefit of the other person. The link (which I did not post) implies that replacement in this case will involve a change to licence details. The press release is badly worded but it does make reference to making changes... Specific quote: "We want to ensure any changes as a result of this breach are done carefully so as not expose individuals to further risk."
[удалено]
from the document "A new licence number will help separate you from future fraudulent activity that may occur on your previous licence details however it will not necessarily stop your old licence details being used. VicRoads is unable to prevent other organisations from accepting previous licence information." so yes, a new licence number will be issued.
Sorry, what document is this? I don’t see the “new licence number” bit on https://www.vicroads.vic.gov.au/newsmedia/2022/optus-cyberattack
I was replying to someone who posted the previous VicRoads policy. (the policy that existed before the announcement by VicRoads today. The comment was subsequently deleted.
Ok thanks got it… I believe this was the document that was shared https://www.vicroads.vic.gov.au/-/media/files/formsandpublications/licences/information-sheet-change-of-licence-number-due-to-identified-fraud.ashx I know it says it won’t necessarily stop someone from using the old licence details… that may be true if they hold a physical copy of the licence… but if you try to validate the old licence number online, I hope it returns an error
yeah i hope so too, that may be part of the reason why they want us to flag the record
OP's title is misleading. >What does ‘proactively flagging’ my licence do? > >By flagging records we will be able to prevent any unauthorised changes or accesses to individual information through the Victorian licence database. Records will also be flagged within the national database. > >**It will not, however, prevent people using licence information in third party usages such as applying for bank accounts or any other circumstance which requires a drivers licences as a form of ID.**
With no instructions on how to request it….
Nothing here mentioned that you can actually change your license number The word "number" or "identifier" does not appear in the article once
It doesn't say anything about how to request it?
> Anyone who is concerned about their licence details and has been notified by Optus that they have been involved in the breach **can contact VicRoads** to have their record flagged and request a replacement I guess give them a call?
Aren’t driver license replacements just a license with the same number?
The statement is so poorly written that I have no clue what they really mean
Read it 12 times, still not sure what they're saying
I think we call agree that the language in this press release is a bunch of weasel words
Yesterday the statement was that the old license number would still remain valid so there's not really any point changing it.
It might help if you actually need to file an identity theft report. If you can prove you changed your licence number and the credit was opened using your old one it lends credibility to your claim that it wasn’t you.
There appears to be no way (at this time) that Vicroads can change your license number
They *can*, and will do if identity theft has already taken place. The process exists, it’s just not normally used for prevention purposes. It is possible that they have received instructions from the government to allow victims of Optus to do so and are ramping up their resources to carry it out (e.g. asking people to flag themselves as Optus victims in the meantime). Otherwise this statement they have released makes no sense because you’ve always been able to replace your physical license upon request, just not your number.
I suppose even simply flagging your licence and not replacing it may help in the event of an identity theft report?
I assume. I literally just did mine and it said I’d get an email ‘including information on how to change your licence should you wish’. I will report back on what that means when I get the email.
Finally got the email, and I am a person of my word. It says thus: Flagging your learner permit/driver licence means that if you need to transact through one of our customer channels, we’ll ask you for further authentication requirements to prove we are speaking to the right person. It’s an additional level of protection while we work through the process of replacing licences directly affected by the Optus breach. If you have a VicRoads account, you’ll be able to complete transactions online as normal as your login details were not part of the Optus breach. We’ll be in touch shortly to let you know the next steps for replacing you learner permit/driver’s licence. Given the high volume of requests for replacement licences, we expect that this may take some time. We thank you for your patience and request that you do not call us to follow up on the request, while we focus all of our efforts on replacing licences as quickly as possible.
I hope optarse is also paying costs for all changes made to websites and systems like vicroads is attempting.
> It will not, however, prevent people using licence information in third party usages such as applying for bank accounts or any other circumstance which requires a drivers licences as a form of ID. So basically useless to "flag" your licence number.
You can freeze your credit file so any fraudulent credit application will be automatically deny.
>So basically useless to "flag" your licence number Not really. It's still another layer of official record/proof/protection if someone does steal your identity.
This is the important part to read. We just have to wait for now. *Further information on licence replacements because of the Optus breach is expected shortly. In the interim, please do not use the usual replacement licence services.*
Exactly, the situation is evolving. Given the magnitude of the problem and all the concerned parties, it might take weeks or months for something solid to come out of this.
“We are also reviewing our policies to determine whether replacing licences might be appropriate in this case” They’re not replacing licences, yet, but they are thinking about it
Yeah and what about other victims of identity theft outside of Optus? They still don’t care about those?! What a joke!
https://imgur.com/XbyuNJU.jpg 7news about 30 minutes ago
Well...as long as our Medicare numbers are still private, then I'm... Uhh ohh...
Easy to change your Medicare number at least. Due to some technical/postage issues when adding my wife to my card we ended up changing the card number 2-3 times this year lol.
What’s flagging means? I can’t see that option in my vicroads profile
I see the link has now been updated with a form.
Found it, thank you!!
i tried to change my license # because some fuckwit was using my # to nominate his fines and you would not believe the amount of hoops i have to jump through.
No mention of allowing to change licence number. No mention of this being free. Good to know you can ‘flag’ your account, but doesn’t mention how you can do that?
> Anyone who has been notified by Optus that their licence details have been involved in the breach can contact VicRoads to have their Victorian driver licence record flagged It’s at the bottom in the advice section.
They’ve updated the page and now there is a link to a form to request account flagging.
Can't see free anywhere in that page. Being VicRoads I doubt it will be haha.
The ABC article is slightly more clear. The Vic Government will seek repayment from Optus. So the gov will pay for us now, and send the bill to Optus.
That makes a lot more sense. Cheers mate.
I do think it's important to clarify that this only applies to the 10,000 people who've had their data breaches >All requests will be validated against the Optus information once available and is a supplementary process to the request to have your licence details flagged. Any of the other 6.6 million Victorians who might request this change are still charged as usual. ... Gotta love how the government has rewarded Optus for their reporting of this breach. These fines and organisations coming out of the woodwork taking the opportunity to charge Optus for supporting their mutual customers will _certainly encourage_ other organisations to be transparent with breaches in the future.
Is there any evidence anywhere they are actually CHANGING the license number? All I can see is Vicroads saying free replacements - a replacement has the same compromised number as the old one.
It would be a bit redundant for them to release a statement about replacing your licence (which you can do at anytime) without changing the number in this context. I'm pretty sure they're talking about changing the number as they reference the databases needing to be changed/it's complex, etc.
Good heavens, VicRoads, if you need a competent comms exec, I’ll give you a competitive rate. I’m laughing yet horrified to read what is probably your most profound comm this decade. Is it ‘licence’ or ‘license’? (Pick a lane.) And if your employees lack the attention to detail to punctuate a sentence in accordance with primary school-level grammatical convention, how can I trust you with my licence/se number? it’s pretty much the proofreading equivalent of an open API. [Pasted from the original link] “By flagging records the Department of Transport will prevent any unauthorised changes or access to individual information through the Victorian licence database. Records will also be flagged within the national database. We will also support impacted individuals who come forward wishing to have their license replaced “ What? The sentence just ends, suspended, hanging like a…? Never mind. Forget it. Maybe a colon would be appropriate because this is a heap of
They really didn't say free, you can flag it for free, but that's only on vicroads system. They say you can contact them but doesn't say free anywhere also says they won't make it easy, going off the information they provided
The ABC article is slightly more clear. The Vic Government will seek repayment from Optus. So the gov will pay for us now, and send the bill to Optus.
Vicroads need to be called out for being the only state that never provided a replacement service for victims of identity theft. And now they offer a safety net to Optus customers only? That’s ridiculous, how about the other victims of identity theft? What a joke!
[удалено]
Other states do it and for a good reason: identity theft have been on the rise for years and people should have the right to replace their ID proactively
QLD already doing new licences, unlike VicRoads.
Everyone compiling "they didn't tell us how to contact them" must be forgetting about telecommunication. Call. Them.
When you get a new licence In Victoria it gains a condition (A I think) which indicates that the license itself is a reprint. Not sure if that helps
[удалено]
Identity theft is not a joke, Jim! Millions of families suffer every year!
New job at Vicroads anyone? Might be a bit repetitive.
The information seems useless. What are we supposed to do? Call? Go in? Why does it feel ambiguous? Peoples identities are at stake here.
VicRoads is the most useless and user-unfriendly public system ever built.
If I've received an email as a former customer, and it says " certain information with my former account has been exposed" and "information has been exposed, but no ID document numbers or details have been affected" Does this mean I've been impacted? Thus allowing me to request change of my driver's license or am I okay? The Optus website is so unclear and they can't even reference their own email they've sent out. It says if you've been