Tangerine Data Breach (2024): What Was Exposed & What To Do

In February 2024, Australian telecommunications provider Tangerine experienced a data breach that exposed records belonging to roughly 243,000 people. The incident, reported on 18 February 2024, was linked to a legacy customer database and released personal details that included names, contact information, dates of birth and password data stored as bcrypt hashes.

Public reporting confirms the scale and the categories of information involved, but does not disclose the precise technical method of access or any named threat actor. The event matters because the exposed fields are the building blocks of identity fraud and targeted social engineering.

What happened

According to available reporting, Tangerine, an Australian telco, suffered a data breach in February 2024 that affected more than 200,000 customer records—specifically tallied at 243,000 people. The exposure was attributed to a legacy customer database. The data released included physical addresses, email addresses, names, phone numbers and dates of birth. Passwords that had previously been used in a traditional login system were also present, stored as bcrypt hashes.

Tangerine’s current authentication process relies on a one-time password sent after a customer enters an email address and phone number; the older password-based system is no longer in active use. Beyond the attribution to the legacy database and the listed data categories, further operational details such as the exact intrusion vector, duration of unauthorised access, or any ransom demand remain undisclosed in public sources.

How a breach like this happens

Incidents involving legacy customer databases typically arise when older systems continue to hold sensitive records after newer platforms have taken over day-to-day operations. These repositories may retain weaker access controls, outdated encryption practices, or incomplete network segmentation. Attackers who gain an initial foothold—through phishing, credential stuffing, or an unpatched service—can then locate and extract the older data store.

Because legacy systems are often less actively monitored, the extraction may go unnoticed for a period. Once the data leaves the organisation, it can appear on criminal forums or leak sites. No specific threat group has been publicly attributed to this particular incident, so the general pattern above is offered only as background on how such exposures commonly unfold, not as a reconstruction of Tangerine’s case.

About Tangerine

Tangerine is an Australian telecommunications company that supplies mobile and related connectivity services to retail customers. Like other telcos, it necessarily collects and retains customer identity and contact data in order to provision services, bill accounts and meet regulatory requirements. That information routinely includes names, addresses, phone numbers, email addresses and dates of birth—precisely the categories reported in this breach.

A breach at a telecommunications provider is consequential because the data set is both large and high-value: it links real-world identity documents to active communication channels. Customers rely on the provider to keep that linkage private; any compromise can undermine trust and create downstream fraud risks for the individuals concerned.

What was likely exposed

Public reporting names the following categories as present in the exposed records:

• Dates of birth
• Email addresses
• Names
• Passwords (stored as bcrypt hashes from a prior authentication system)
• Phone numbers
• Physical addresses
• Salutations

The exact contents of every record are not independently verified beyond these listed fields. Organisations of this type typically also hold account numbers, service history and payment references, yet those additional elements have not been confirmed as part of the 2024 exposure. The passwords were not stored in clear text; they appeared as bcrypt hashes, which still require computational effort to reverse but remain a risk if the same credentials were reused elsewhere.

Why it matters

For affected individuals the combination of name, date of birth, physical address, email and phone number supplies enough material for identity-theft attempts, SIM-swap fraud or highly personalised phishing. Even hashed passwords can be cracked offline if the original passphrase was weak, potentially unlocking other accounts where the same password was reused. The presence of salutations adds a further personalisation layer that can make fraudulent messages appear more legitimate.

For the organisation the breach creates regulatory notification obligations, potential compensation claims and lasting reputational damage. Customers may question whether other systems remain secure, and the company must demonstrate that the legacy database has been isolated or decommissioned. Because the data set is already in circulation, residual risk continues even after internal containment.

If your data was in this breach

If you were a Tangerine customer around the time of the incident, treat the listed fields as potentially compromised. Change any password you may have used with the older login system and ensure it is not reused on other services. Enable multi-factor authentication wherever available, especially on email and financial accounts. Monitor bank and credit statements for unexpected activity and consider placing a fraud alert with relevant credit-reporting bodies. Be sceptical of unsolicited calls or messages that reference personal details now known to be exposed.

Readers can also run a free exposure scan of their email address to check whether that address has appeared in this or other known breach data sets. Doing so provides an early indication of wider reuse of the same credentials and helps prioritise further protective steps.

AICompiled with AI assistance from public sources and published under our editorial standards.