November 18th 2016
Three men have been arrested and charged as a result of the data breach on mobile network Three.
Unusually, the stolen data was used by the fraudsters to steal mobile handsets, but Three’s nine million customers are being warned by Get Safe Online to change their passwords and be vigilant for potential hoax communications claiming to be from the network.
The company has said that customers' financial information was not affected as it was not stored on the same system. Following such breaches, however, companies’ customers are frequently targeted by opportunist fraudsters warning them that their account has been breached or that they need to confirm their confidential details. Such approaches are most often made by email or phone call, but can equally be via text message or even social media post.
Customers are also warned to change their passwords as an additional precaution. The same password should never be used for more than one online account, see our advice here.
It revealed that the fraudsters – two from Manchester and one from Kent – had accessed personal data by using authorised logins to its database of customers eligible for handset upgrades. They used the information to be arrange for the phones to be despatched to eight customers, but intercepted them before they arrived. The data included customers’ names and addresses. Three is currently investigating the total number of customer records compromised by the breach.
The National Crime Agency arrested the 48-year-old Kent man and a 39-year old Manchester man on Wednesday on suspicion of computer misuse offences. A 35-year old man from Manchester was also arrested, on suspicion of attempting to pervert the course of justice. All have subsequently been released on bail.
A Three spokesperson commented: “Over the last four weeks, Three has seen an increasing level of attempted handset fraud. This has been visible through higher levels of burglaries of retail stores and attempts to unlawfully intercept upgrade devices. We’ve been working closely with the police and relevant authorities. To date, we have confirmed approximately 400 high-value handsets have been stolen through burglaries and eight devices have been illegally obtained through the upgrade activity. The investigation is ongoing and we have taken a number of steps to further strengthen our controls.”
The spokesperson added: “In order to commit this type of upgrade handset fraud, the perpetrators used authorised logins to Three’s upgrade system. This upgrade system does not include any customer payment, card information or bank account information.”
The breach follows an attack on TalkTalk in October last year when the personal data of approximately160,000 customers was accessed, and last week’s attack on Tesco Bank’s systems which resulted in 9,000 account holders losing money.
