ACMA gives a bit of technical detail on Optus data breach, it's as dumb as you think

ACMA has confirmed in a filing with the Federal Court that it was Optus' incompetence that lead to one of the biggest data breaches in Australian history. It wasn't sophisticated hackers, foreign actors or a criminal gang's fault, it was a "coding error" that lead to the access controls for api.www.optus.com.au "vulnerable for attack" for two years and "was not decommissioned despite the lack of any need for it". This API end point happened to return customers personal identifying information. ACMA even says "the cyberattack was not highly sophisticated or one that required advanced skills or proprietary or internal knowledge of Optus' processes of systems".