iiNet data breach: over 280,000 customers' data exposed

The iiNet data breach has exposed over 280,000 customers. Fortunately, it was their order management system and did not have financial details.

The breach was likely via an employee’s account credentials, showing yet again how easy it is to obtain these by coercion or deception.

Data extracted included

280,000 active iiNet email addresses
20,000 active iiNet landline phone numbers
Unspecified number of ‘inactive email addresses and numbers’
Around 10,000 iiNet usernames, street addresses and phone numbers
Around 1,700 modem set-up passwords (Admin passwords)

TPG will contact any impacted customers to ‘advise of any actions they should take and offer our assistance’. Non-impacted iiNet customers will also be contacted.

What to do about the iiNet data breach

Regardless of whether you are impacted or not, you need to immediately change the Admin Login password for the iiNet-supplied modem/router. Also, change your iiNet account password, and if it’s one you have used several times, track those other uses down and change them.

There is a password reset support page that walks you through how to create a new password for your iiNet account (but not the modem/router).

How do I reset my iiNet router password?

Hopefully, the admin login (admin) and password will be on the manufacturer’s label on the modem/router. Care – it is not the SSID and password you use for Wi-Fi.

Access this via the router’s IP address in a browser. Find the Administration area and change the admin password there. Write it down, preferably on the back of the router, so you can access it again.

If this does not work, call the support number and ask for the Admin Login and Password.

As a last resort, you can reset the router (there should be a reset pin hole), which will revert the router to the Admin password and reset the Wi-Fi SSID to what is on the label. Only do this if you are tech-savvy, as you will need to set up new SSIDs and passwords.

Do not answer any iiNet or TPG emails or click on any links – they will be a scam for sure.