Optus data breach: Australian states and territories clarify replacement driver licence requirements

Thousands of motorists across Australia impacted by the Optus data breach face a harder battle than first thought if they want a new licence number.

It turns out, due to strict requirements by each state and territory, new licence numbers are only issued in extremely rare cases in some jurisdictions.

Instead, most Optus customers impacted by the data breach are being advised they may only be eligible for a new licence card number.

This is of little comfort to most affected people because the licence number is what is needed by fraudsters. Licence card numbers are rarely recorded or used to identify people.

Last month, Optus was struck by a cyber attack which stole the data of almost 10 million Australians – resulting in criminals gaining access to private information such as driver’s licence numbers and Medicare card details. 

However, weeks later, thousands of drivers are still left in the lurch. Licence numbers stay with individuals throughout their life, while new card numbers are issued every time a new driver’s licence is created.

While some states have the capacity to replace both the card and licence number, New South Wales, Victoria, the Australian Capital Territory and Tasmania have said only the card number needs to be reissued to reduce the risk of identity theft – thanks to stronger anti-fraud laws recently enacted in Australia.

On September 1, 2022, enhanced Document Verification Service (DVS) laws came into effect nationwide, requiring both a licence number and card number to pass a check. But not every jurisdiction has introduced the changes.

Service NSW says only motorists “who believe they have been the subject of genuine identity theft or fraud” will be able to apply for both a new licence and card number. 

“Replacing a NSW driver licence will provide customers with a new card number, protecting them from unauthorised DVS checks using the old card's information,” says a statement on the Service NSW website.

In Victoria, Tasmania and the Australian Capital Territory, motorists who have been notified by Optus that their data has been breached can apply for both a new licence number and card number.

Speaking with Nine News Sydney, New South Wales Customer Service Minister Victor Dominello explained replacing a licence number would be a lengthy process.

“If you want your driver’s licence number changed, that’s like open-heart surgery. That will take many weeks, if not months,” Mr Dominello told Nine (owner of Drive.com.au).

“The best thing to do is to change your card number.” 

Optus has said it is working with state and territory governments to help affected motorists, offering to cover the cost of new licence numbers.

“We’re working closely with the government of each state or territory to understand the risks and devise processes to help customers in the event ID documents need to be changed,” said an Optus statement posted online.

“Where these agencies recommend that an ID document should be changed, we will provide this advice and the steps required to do this directly to impacted customers.

“We will be directly contacting customers nationwide who have had their driver licence number and/or licence card number exposed as a result of the cyber attack.”