Vodafone Customer Bank Details Accessed in Hack

Just over a week ago, TalkTalk’s website fell victim to a cyber-attack and revelations have emerged regarding the company’s poor security infrastructure. It seems these attacks are becoming more prevalent as today, Vodafone admitted a data breach involving 1827 customers’ personal information. This include their bank details and telephone number. A spokesperson from Vodaphone confirmed the attack, and reaffirmed that it wasn’t due to their security measures:

“This incident was driven by criminals using email addresses and passwords acquired from an unknown source external to Vodafone. Vodafone’s systems were not compromised or breached in any way.”

“Whilst our security protocols were fundamentally effective, we know that 1,827 customers have had their accounts accessed, potentially giving the criminals involved the customer’s name, their mobile telephone number, their bank sort code, the last four digits of their bank account,”

“Our investigation and mitigating actions have meant that only a handful of customers have been subject to any attempts to use this data for fraudulent activity on their Vodafone accounts.” 

A number of sources on Twitter have suggested the attack came from The Dark Web:

Vodafone says seen attempts to access 1,827 customers accounts after data theft – but says data came from dark web, no breach of its systems

— Rory Cellan-Jones (@ruskin147) October 31, 2015

The spokesperson went on to discuss the data loss’ ramifications and said:

“However, this information does leave these 1,827 customers open to fraud and might also leave them open to phishing attempts,”

“These customers’ accounts have been blocked and affected customers are being contacted directly to assist them with changing their account details.”

I do find Vodafone’s excuse to be fairly laughable and they have to take responsibility for the data loss. Professionals aren’t going to hack a major network without some form of protection and will make it difficult to trace. The information gathered is more than enough to cause chaos in terms of a person’s bank balance and can be used to help find other details like an email address.