No passwords or bank details were taken, according to the Singapore-owned firm.
It is not yet clear whether the attack came from a state-based or criminal organization, but Bayer Rosmarin said no ransom demand had been made.
“It’s too early to rule out any possibility,” she said, adding that police and the Australian government were investigating.
“We don’t yet know who these attackers are and what they want to do with this information.”
The Australian Competition and Consumer Commission warned Australians who were potentially impacted a number that matches almost half the country’s population that they could be at risk of identity theft.
“Optus customers should take immediate steps to secure all of their accounts, particularly their bank and financial accounts. You should also monitor for unusual activity on your accounts and watch out for contact by scammers,” the watchdog said.