Your data was 'taken without permission', customers told, after personal info accessed in O2 UK partner's database

Hackers have slurped biz comms customers' data from a database run by one of O2's largest UK partners. In an email sent to its customers, the partner, Aerial Direct, said that an unauthorised third party had been able to access customer data on 26 February through an external backup database, which included personal …

[rndSheeple]

6 years past customers names and birth dates etc... nice

I am quite sure that as it was a "backup" they never harassed (marketed?) their ex customers and just kept this for the sheer joy?

Even though I am not blighty based I would wager 30% of my right testicle that they will not get fined for GDPR breach due to backups being difficult to access and partially delete afterwards. Except for the magical hackers who just got access passing all the difficult bits by with a wave of the black hat.

[robidy]

Re: 6 years past customers names and birth dates etc... nice

Congratulations, your right testicle is now 25% bigger (HMRC have taxed your stake)

[Anonymous Coward]

Re: 6 years past customers names and birth dates etc... nice

Yeah, thankfully, IIRC I left 7 years ago. So hoping my info ain't in there. No doubt some other leak has it, but not this one.

[tfewster]

Yeah, yeah

Another copy-pasted statement* in response to a breach. If only they had spent as much time Googling "security" before the event as they did finding the Excuse Database afterwards...NSFW

*At least they didn't include the lie the "security is paramount".

[Anonymous Coward]

with assistance from experts

Call me cynical but if they employed experts in the first place while setting these up these databases up in the first place they wouldn't have these problems. It could also solve replications and duplication issues.

[Norman Nescio]

Re: with assistance from experts

Call me cynical but if they employed experts in the first place while setting these up these databases up in the first place they wouldn't have these problems. It could also solve replications and duplication issues.

Cynical, the Muphry is strong here.

[DavCrav]

Re: with assistance from experts

"[...] in the first place [...] these up these databases up in the first place [...] It could also solve replications and duplication issues."

I cannot decide if I prefer that to be intentional or unintentional.

[Anonymous Coward]

Re: with assistance from experts

It was intentionally unintentional, hope that clears it up.

[Justin Case]

Mother Brown (to the tune of)

These up, these up

Don't get the breeze up

These up Mother Brown

[Anonymous Coward]

No further comment

While I'm not into testicle bets, I suspect that the statements they've made are all that they're going to say about it.

I also suspect that the 'hacking' involved someone finding an unencrypted file on an unprotected server.

[Doctor Syntax]

"a full investigation to determine what happened "

Somehow I suspect it might be more a case of what didn't happen. Some little thing like securing the backup.

[Pascal Monett]

"able to access customer data on 26 February through an external backup database"

Um, one question : how is it that a "backup" database was accessible through the Web ?

It is child's play for an experienced, competent administrator to firewall any part of his network from the Internet if he has the funding and the will of the Board. The fact that the backup was "external" changes nothing. Am I to understand that the admin in charge did not have those elements, or that he is incompetent ? Which is it ?

[A.P. Veening]

Re: "able to access customer data on 26 February through an external backup database"

Which is it ?

The board wasn't willing to spend the money, so now the board gets to pay manifold in fines next to the necessary spending on security.

[The Dogs Meevonks]

Re: "able to access customer data on 26 February through an external backup database"

Typically the fine is far, far lower than the cost of adequately securing the data and ensuring it's continued security to begin with. So they always go with the cheaper option.

[A.P. Veening]

Re: "able to access customer data on 26 February through an external backup database"

Typically the fine is far, far lower than the cost of adequately securing the data and ensuring it's continued security to begin with. So they always go with the cheaper option.

It used to be cheaper, but now with GDPR (and the Californian equivalent), that is changing and in my not so humble opinion for the better.

[Anonymous Coward]

"partners"

I've always thought it really bizarre that Vodafone and CellnetO2 conduct some of their business using these pointless, parasitical, wasteful and very literal man-in-the-middle "reseller" "partner" setups, when the other mobile networks don't. Surely it would make more sense to not bother with middlemen and cut out the cruft? What "value", if any, do they actually add? You would also think/hope (hmmm) that if customer data were only stored in-house by the telco themself, the magnifying effects of scale/competency would at least hopefully mean a greater chance of data being processed properly securely (yes, I know...).

[bpfh]

Re: "partners"

Probably works when they have to manage custom & special setups that go beyond a mobile phone or a WiFi hotspot, like systems requiring 4G Cisco routers and embedded stuff, along with the corresponding vpn support that goes beyond what any customer facing telco team are able to talk about?