I'm worried about SIM-swap fraud. What should I do?

Contact Tangerine and ask them to set a port-out PIN (also called a transfer PIN or account PIN) on your service. This adds an extra check before your number can be transferred to another carrier. It is also worth moving any high-value two-factor authentication off SMS and onto an authenticator app such as Google Authenticator, Authy, or 1Password, which cannot be intercepted by a SIM swap.

Was my Tangerine password exposed?

No. Tangerine confirmed that customer account passwords were not in the exposed dataset. As a precaution it is still generally considered good practice to change your Tangerine password and any other accounts where you may have reused it, since the breach included email addresses that could be used in credential-stuffing attempts elsewhere.

I've left Tangerine. Am I still at risk?

Potentially yes. The exposed dataset included historical customer records, not just current subscribers. If you were ever a Tangerine customer and supplied your name, date of birth, mobile number, email, and address, that information may have been included. The same steps apply: review identity protection and monitor for targeted phishing.

Could attackers transfer my number to another carrier?

Australian telecommunications carriers are required under ACMA rules to verify the identity of anyone requesting a port-out, and most use multi-factor verification. However, identity verification can be defeated where the attacker has enough personal data. Setting a port-out PIN with Tangerine (or your current carrier) adds an additional layer that an attacker is unlikely to know.

What does Tangerine say about who got in?

Tangerine attributed the intrusion to the use of a third-party contractor's old login credentials, which had remained active after the contractor's engagement ended. The carrier has not publicly disclosed full forensic detail, including the identity of the attacker or whether the data has been published or sold. Affected customers were advised to remain vigilant for scams referencing their Tangerine account details.

Tangerine Telecom Data Breach 2024:
What You Need to Know

Approximately 232,000 Tangerine Telecom customer records were exposed in February 2024 after an attacker used a third-party contractor's old credentials to access a system containing customer data. Here is what happened, what was leaked, and steps you can take to protect yourself.

Breach date:18 February 2024

Records affected:~232,000

Risk level:High

Your personal risk from this breach

View My Risk

What Happened

How the Tangerine Breach Unfolded

Late 2023

A contractor's legacy login credentials remained active on Tangerine systems despite the contractor leaving the engagement in mid-2023. Dormant accounts of this kind are a recurring weak point flagged by the OAIC in notifiable breach reports.

January 2024

An attacker used the dormant contractor credentials to access a Tangerine staging/test environment that contained copies of customer records. Test environments often hold real production data without the same hardening as live systems.

18 February 2024

Tangerine confirmed the breach publicly, notified the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme, and began emailing affected customers.

Not sure if you received this notification? Affected customers received an email referencing a "Tangerine Telecom data security incident" with details of what data was exposed.

Late February to March 2024

Tangerine rotated credentials, removed legacy contractor accounts, and engaged forensic specialists to confirm the scope of the intrusion. The carrier said no further unauthorised access had been detected following the remediation work.

Sources: Have I Been Pwned, OAIC Notifiable Data Breaches

What Was Exposed

Personal Data Leaked in the Breach

The exposed dataset combined identity-verification fields commonly used by banks and telecommunications carriers to confirm who you are over the phone. That makes the data particularly useful for identity-fraud and SIM-swap attempts.

Data Type	Risk Level	Who Was Affected
Full name	High	All approximately 232,000 affected customers
Date of birth	High	All approximately 232,000 affected customers
Mobile number	High	All approximately 232,000 affected customers
Email address	High	All approximately 232,000 affected customers
Postal address	High	All approximately 232,000 affected customers
Tangerine account number	Medium	All approximately 232,000 affected customers

Risk levels based on the OAIC: What is personal information? and OAIC Australian Privacy Principles. Identity-linked data (name, date of birth, address, mobile number) is rated higher because the combination is commonly used to verify identity at banks and telcos.

✅ Confirmed NOT Exposed

Tangerine confirmed that customer passwords were not in the exposed dataset. Payment-card details and bank-account numbers are processed by a third-party payment processor under PCI-DSS scope and were not affected. SIM and IMSI data were not in scope for this incident.

Company Response

What Tangerine Did

“We sincerely apologise to affected customers. The security of customer information is something we take extremely seriously.”
Tangerine Telecom, customer notification (Feb 2024)

Actions Taken by Tangerine

Disabled the compromised contractor credentials
Notified the OAIC under the Notifiable Data Breaches scheme
Rotated credentials and removed legacy contractor and staff accounts
Engaged forensic specialists to confirm the scope of the intrusion
Began emailing affected current and former customers with details of what data had been exposed
Referred concerned customers to IDCare for free identity-support guidance
Committed to improving access management and removal of unused accounts

OAIC Notifiable Data Breaches Tangerine Telecom

What Now?

Steps You Can Take After the Tangerine Breach

Even though no passwords or payment data were exposed, the combination of name date of birth mobile number email and address is exactly what is used to verify identity at banks and telcos. That makes SIM-swap and identity-verification fraud the main risks to plan for. Here are general best-practice steps, organised by the types of accounts most commonly affected.

Tangerine and Telco Accounts

Your mobile service is the gateway to SMS-based MFA. Securing it limits SIM-swap risk.

Reset your Tangerine portal password and enable MFA

~5 min

It is generally considered best practice to update the password on any Tangerine account associated with exposed data, and to enable multi-factor authentication where the portal supports it. Where the same password has been reused on other services, those should be updated as well.

Go to Tangerine

Set a port-out PIN with Tangerine

~10 min

Contact Tangerine directly and ask for a port-out PIN (also called a transfer or account PIN) to be added to your service. This is an extra value the carrier checks before allowing your number to be moved to another carrier, and helps protect against SIM-swap fraud where an attacker has enough name date of birth and address data to impersonate you.

Review billing and request itemised call records

Reviewing your recent Tangerine bills for unfamiliar charges or services, and requesting itemised call records if your portal supports it, can help surface any account changes you did not authorise. Where something looks off, raise it with Tangerine support immediately.

Email and Digital Identity

Your email is the key to your digital identity. Securing it is a sensible first step.

Strengthen email security

~5 min

Updating the password and enabling MFA on email accounts associated with the breach is widely recommended. It is also worth checking email forwarding rules and connected app permissions, as these can be exploited to silently intercept communications.

Move high-value MFA off SMS where possible

Because your mobile number was exposed, SMS-based two-factor codes carry slightly higher risk in the event of a SIM swap. For banking, email, and primary social accounts, consider moving MFA from SMS to an authenticator app such as Google Authenticator, Authy, or 1Password.

Understand your full account exposure

Most people have dozens of online accounts linked to a single email address. When that email is exposed in a breach, understanding which services are connected is a critical first step in assessing personal risk. Tools that map your digital footprint can help identify accounts that may need attention.

Identity Protection

Name + date of birth + address + phone is the standard kit used to verify identity at banks.

Consider a credit ban (recommended for AU residents)

~20 min

With name date of birth and address in the exposed dataset, the combination could potentially be used in fraudulent credit applications. Placing a free credit ban with Australian credit bureaus prevents new credit from being opened without additional verification, and can be lifted again when you next legitimately apply for credit.

Equifax AU Experian AU (formerly Illion)

Be cautious of identity-verification phone calls

Banks, telcos, and government services commonly verify identity using name date of birth and address. Because all three are in the exposed dataset, treat any inbound call asking you to confirm those details with caution and, where possible, hang up and call the organisation back on a number you have looked up independently.

Monitoring and Reporting

Australian resources for breach response, telco complaints, and identity protection.

Stay alert for targeted phishing

Exposed name email and Tangerine account number may be used to craft highly convincing phishing messages that appear to come from Tangerine. Treat any unsolicited contact referencing your Tangerine account with caution, and verify directly through the Tangerine support channels you have used before.

Contact IDCare, Scamwatch, or ACMA

IDCare (1800 595 160) is Australia's national identity and cyber support service and provides free, tailored guidance for people affected by data breaches. Reporting scams to Scamwatch contributes to broader awareness, and the ACMA oversees telco obligations around customer identification and port-out verification.

Not sure which of your accounts are affected?

In The Event Of discovers your accounts automatically and alerts you in real time when new breaches affect your data.

Check My Email Free

Are You Still at Risk?

The Hidden Danger: Compound Breach Exposure

The Tangerine breach did not happen in isolation. If your data also appeared in other major Australian telco or healthcare breaches, the combination of leaked information can build a more complete identity profile.

How breach data compounds

On its own, the Tangerine breach exposed names, dates of birth, addresses, mobile numbers, and emails. But if your email also appeared in the Optus or Medibank breaches, the combined data set may include identity documents, Medicare details, and health records. This kind of compound exposure significantly increases the risk of identity fraud and SIM-swap attacks.

Optus (2022)9.8M telco records - passport, licence, Medicare numbers
iiNet (2025)200K ISP records - account and contact details
Telstra (2022)Historical employee and customer exposure
Medibank (2022)9.7M records - increases phishing risk for the same demographic

If your email appears in two or more of these breaches, your risk level is significantly elevated. In The Event Of can overlay your breach data to show exactly where your exposure compounds, and help you prioritise what to address first.

Were you affected?

Find out in 30 seconds. Free to check.

Check My Email Free

No credit card required.

Frequently Asked Questions

Tangerine Breach FAQ

Sources

Other Major Australian Data Breaches

Data from multiple breaches can be combined to increase identity fraud risk. Review these guides to understand your full exposure.

NYC Health + Hospitals Data Breach 2026

~1.8M records exposed

Critical

Australian Courts Data Breach 2026

Thousands of files records exposed

Critical

youX Data Breach 2026

~444K records exposed

High

Prosura Data Breach 2026

300K-500K records exposed

High

Canvas (Instructure) Data Breach 2026

~275M (claimed) records exposed

Medium

Booking.com Data Breach 2026

Undisclosed records exposed

High

McGraw Hill Data Breach 2026

13.5M records exposed

High

Crunchyroll Data Breach 2026

Undisclosed records exposed

High

Eurail Data Breach 2026

300K+ records exposed

High

Basic-Fit Data Breach 2026

1M records exposed

High

Under Armour Data Breach 2025

72M records exposed

High

Salesforce (ShinyHunters) Data Breach 2025

~1B records exposed

High

Allianz Life Data Breach 2025

2.8M records exposed

High

Workday Data Breach 2025

Undisclosed records exposed

Medium

Western Sydney University Data Breach 2025

10K records exposed

High

Genea Fertility Data Breach 2025

940K records exposed

Critical

DeepSeek Data Breach 2025

1M records exposed

Medium

Australian Clinical Labs Data Breach 2022

223K records exposed

Critical

Qantas Data Breach 2025

5.7M records exposed

High

Optus Data Breach 2022

9.8M records exposed

Critical

Medibank Data Breach 2022

9.7M records exposed

Critical

Latitude Financial Data Breach 2023

14M records exposed

Critical

MyDeal (Woolworths) Data Breach 2022

2.2M records exposed

High

View all breach guides →

Disclaimer: This guide is provided for general informational purposes only and does not constitute legal, financial, or professional advice. The information is based on publicly available sources at the time of writing and may not reflect the most current developments. In The Event Of Pty Ltd (ABN 38 687 352 647) is not affiliated with Tangerine Telecom. If you believe you have been affected by this data breach, we recommend contacting the relevant authorities and seeking professional guidance specific to your circumstances.

Tangerine Telecom Data Breach 2024:What You Need to Know

How the Tangerine Breach Unfolded

Personal Data Leaked in the Breach

✅ Confirmed NOT Exposed

What Tangerine Did

Actions Taken by Tangerine

Steps You Can Take After the Tangerine Breach

The Hidden Danger: Compound Breach Exposure

How breach data compounds

Were you affected?

Tangerine Breach FAQ

I'm worried about SIM-swap fraud. What should I do?

Was my Tangerine password exposed?

I've left Tangerine. Am I still at risk?

Could attackers transfer my number to another carrier?

What does Tangerine say about who got in?

Other Major Australian Data Breaches

Tangerine Telecom Data Breach 2024:
What You Need to Know