Report Finds Telstra Ignored Key Vulnerabilities Before Nationwide Outage

Telstra failed to treat critical parts of its timing system as high‑risk and overlooked known vulnerabilities months before they triggered a massive nationwide outage, according to an independent review released by the company. The July 8 disruption affected around 45 per cent of all calls and data sessions on Telstra’s mobile network, leaving hundreds of Triple Zero (000) calls unable to connect.

The report, conducted by Technology Audit Partners (TAP), found that a lack of oversight, unclear responsibility and insufficient staffing contributed to the scale and duration of the outage. Two key engineers were on mandatory leave when the incident occurred, and the alarms that should have alerted staff to the problem were monitored only during business hours by a “limited number” of people.

Telstra chief executive Vicki Brady said the company accepts the findings and is working through the recommendations. She confirmed the outage stemmed from an undocumented design change made in October and a software update that had not been applied to a GPS card. “The cause was consistent with what we said at the time… it was not due to infrastructure failing,” Brady told reporters.

The review revealed the outage began at 2:50am, nearly an hour earlier than Telstra had previously disclosed. It was triggered when a faulty power supply was replaced, resetting a GPS card’s date to 2006, which then cascaded through the network’s timing systems. TAP said the telco took “several hours” to identify the root cause due to unclear ownership of the Network Time Protocol (NTP) system, limited visibility of planned maintenance, and a lack of understanding of early alarm indicators.

The findings paint a picture of a network where critical timing infrastructure was not treated as a priority, despite warnings. As Telstra works to implement the review’s recommendations, the outage stands as one of the most significant failures in the company’s recent history and a stark reminder of the fragility of essential communications systems.