Three Mobile, two alleged hackers, one big customer database heist UK carrier Three Mobile was the victim of a hacking scheme that has reportedly left the records of millions of customers exposed. According to multiple UK media reports citing both Three and the National Crime Agency (NCA), hackers gained access to a Three database containing the account details of possibly six million …
"it depends"
The stories say 6 million records exposed, but from the sound of it it was a fairly low scale amateur operation one customer at a time to enable them to intercept handsets, rather than they downloaded all 6 million records and flogged on the info, which i'd have thought would net more than a few dodgy handsets are worth
@ac - and that is one of my main objections to the snoopers charter. My data is far more valuable to criminals than the government. I have nothing to hide (I.e. not a criminal) but that's not too say I want my surfing habits available to crooks. Consider the Ashley Masterson customers some of whom were blackmailed, consider that if crooks have my mobile number and know I was say a LLoyds or Barclays etc customer based on my surfing history how much easier it makes it to create a more convincing scamming angle. Text through the mobile operators system if they can compromise that two and a message saying to ring the bank on 0123456789 and related to online banking on date/time. Youd maybe drop your guard a little thinking only my bank knew that so it must be legit.
You could phone the customers due for an upgrade and offer them say an iPhone 7 for £20 a month and £100 up front. Can I have your card details and the three digit code please., Confirm your address Should be enough....
It's a massive disaster waiting to happen....
Tin foil hat on.
You don't need to compromise a mobile network to send messages from a sender specified number ( eg: "ThreeUK" ).
You just need a company that has API access to an aggregator ( an aggregator is plumbed into the networks themselves and can specify the sender number ).
There are plenty of them.
"I have nothing to hide (I.e. not a criminal)"
Of course you have something to hide. That's why the "nothing to hide" formula is a big lie to cover the removal of presumption of innocence. And you've fallen for that lie. You clearly do recognise the value of that data: that's the stuff that you should be able to keep hidden, you're probably contractually obliged to keep hidden (check your obligations in the T&Cs of any online accounts you have) and that those with whom you share it should be equally obliged to keep hidden. So why go along with the notion that bad stuff has to be hidden?
The various press reports and Three's own statements make the whole incident very confusing:
Three refers to "authorised logins to Three's upgrade system". Presumably this is an internal system and internal credentials that have been used? Or is it an internet-facing system and customer credentials that have been used?
Three refers mainly to attempted fraud (being very specific mentions about upgrades being ordered for only 8 customers) and makes little mention about data theft. Was data taken or did the intruders just have access to the database which contained the details? There is a big difference between the records of 5m customers being taken and intruders being able to view individual customer details from a database containing 5m records.
Hopefully we will find out more over the next couple of days.
I was 'used' in a catalogue scam a decade ago.
Someone who knew I was out at work ordered 2 mobiles from a mail order catalogue using my name and address.
Soon after the parcels were left with a neighbour, a second person called at the neighbour's house using some excuse about wrong goods being sent, and collected the two parcels.
I find out about the scam a couple of weeks later when an invoice for two phones turns up at my house. Fortunately the catalogue company believed me and didn't make a song and dance about things. (Which led me to believe that I wasn't the only pawn in a crooked undertaking.)
It sounded like an inside job to me.
No hacking here as far as I can see (caveat - based on what I've read so far).
Internal login used, quite possibly by employee or at least someone in collusion with the alleged thieves. Eight customers affected. Sounds like their internal systems for flagging this activity worked - or maybe the insider got careless, who knows?
A similar thing happened years ago when I was a manager at another mobile operator (I won't name them, but ee, the stories I could tell you on a one to one basis). An entire team found a way to force these upgrades and drop ship to marked addresses for collection. Nothing wring with systems or security - someone was determined to find a way around it and greed got the better of them.
Was flagged up very quickly, but allowed to continue (to amass evidence) and then the day came when they were summarily dismissed. Quite a few arrested immediately afterwards too.
Sadly there will always be internal theft - no amount of system security and cross checking is going to overcome that completely - after all, you have to trust that the people you are employing in these roles are honest.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
