It’s rumoured that the attacker(s) were able to access an API that linked to a test environment that didn’t require authentication. This environment had access to Optus’ production customer databases.