AFP investigates $1m ransom demand posted online for allegedly hacked Optus data

The Australian federal police is investigating after the data of millions of Optus customers exposed during a recent hack was allegedly put up for sale online.

On Saturday morning a post appeared on a data market from a user claiming to be in possession of the information obtained from the breach with a demand for $1m in Monero cryptocurrency.

The user posted a sample of the data. The cybersecurity researcher Jeremy Kirk said the sample appeared to correspond to real-world addresses and people, which suggested the post was genuine.

Even if Optus was to pay the ransom, there is no guarantee the user would stick to an agreement not to sell the data elsewhere.

Kirk said he had verified some of the information by speaking to a neighbour whose name and address was contained in the sample.

This information could not be immediately verified but a spokesperson for the AFP said the agency was aware of claims the data had been put up for sale.

The spokesperson warned that it was an offence to buy stolen credentials with those convicted facing a maximum penalty of 10 years in jail.