Australia's second-largest telecommunications provider suffered a catastrophic security failure when an unauthenticated, internet-facing testing API was discovered by extortionists. The actor systematically exfiltrated full names, dates of birth, telephone numbers, physical addresses, email contacts, and millions of driver's licence and passport records [ID Number Redacted].