A data breach compromising the records of up to 9.8 million Optus customers has been referred to the Australian Federal Police for what the agency said would be a “complex, criminal investigation”.