TL;DR: On 16 August 2025, TPG Telecom confirmed someone used an iiNet employee’s stolen login to access an order management system. Taken: 280,000 active iiNet email addresses, 20,000 landline numbers, 10,000 names, addresses and phone numbers, and 1,700 modem set-up passwords. No ID documents, cards or financial details. If your modem still uses its original password, change it today.
What happened
According to Infosecurity Magazine, an "unknown third party" logged in with stolen credentials belonging to an iiNet employee and reached an order management system. TPG discovered it on 16 August 2025, cut off access, brought in external experts and notified regulators. It’s unclear how the login was stolen.
What was taken
| Data | Count |
|---|---|
| Active iiNet email addresses | ~280,000 |
| Active iiNet landline numbers | ~20,000 |
| Usernames, street addresses, phone numbers | ~10,000 |
| Modem set-up passwords | ~1,700 |
| Inactive emails and landlines | Unspecified |
| ID documents, cards, financial info | Not taken, per TPG |
The modem passwords matter most
Most people never change the password their modem shipped with. If yours was one of the 1,700, someone could use it to get into your home network settings. Ten minutes now beats finding out the hard way.
Fix: log in to your modem’s admin page and change both the admin password and the Wi-Fi password. If you’re unsure how, iiNet support can walk you through it.
What to do
- Change your modem passwords (admin and Wi-Fi).
- Watch for iiNet-themed phishing: fake "account suspended", "overdue bill" or "upgrade your modem" emails.
- Don’t trust caller ID. A call "from iiNet tech support" asking for remote access is a scam pattern. See remote access scam recovery.
- Turn on MFA on your email account.
- If you use your iiNet email for everything, check our free exposure check to see other breaches.
A lesson in stolen logins
This breach didn’t need clever hacking, just one employee’s password. It’s the same weakness behind many big breaches, from Qantas to MyDeal.
Frequently Asked Questions
When was the iiNet data breach?
TPG Telecom discovered and confirmed it on 16 August 2025.
How did hackers get into iiNet’s systems?
They used stolen login credentials belonging to an iiNet employee.
Were modem passwords exposed in the iiNet breach?
Yes, about 1,700 modem set-up passwords were taken.
Were credit cards or ID documents stolen?
No. TPG says no identity documents, credit card details or other financial information were compromised.