Slashdot Mirror
T-Mobile UK Employees Sold Customers' Information
angry tapir writes "Workers at T-Mobile UK have been selling customer data to brokers who worked for the competition, according to T-Mobile and the UK's Information Commissioner's Office. Criminal charges are being prepared. 'Many thousands' of customers' account details, millions of records, were sold to several brokers for substantial amounts of money, the ICO said. In an announcement (PDF) from the ICO, the agency does not name the operator involved, but T-Mobile acknowledged that it had alerted ICO about the data breach. The BBC reports that after the other mobile operators said they were not the subject of the investigation, T-Mobile confirmed its involvement."
I'm a T-Mobile Customer. I think they did the right thing, coming forward when it was obvious they had a data breach.
I like T-Mobile, especially because they have great customer support. I have a friend who got overbilled by a lot, and decided to settle instead of going to court over it. My experience with the company though has been pretty good. I'm staying with them.
At what point do the competitors have to take responsibility for purchasing the data? It seems that they should have known the data wasn't kosher.
The likelihood of valuable data being exploited is proportional to it's marketability. The more important the data, the more likely it will be stolen or otherwise exploited. It doesn't matter if it's a company, a utility or a government.
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
I've cancelled direct debits and my contract. Vote with my feet - if they want to be fool enough to sue me for the loss of the contract then they can expect to get countersued for the cost of credit monitoring. Until people start slapping the companies hard by refusing to do business with them this will carry on the UK data protection *laws* are good, but the *penalties* are worthless as a deterrent.
Whom? T-Mobile?
You must be a hit at restaurants. When the waiter gets your order wrong, I'm betting you tell everyone there to not eat at that restaurant again.
It seems to me that T-Mobile did the right thing, and contacted the authorities once they figured out what was going on. You want to punish them for that?
Although, you didn't specify anyone. Perhaps you meant the companies that bought information?
// file: mice.h
#include "frickin_lasers.h"
I wish this problem was exclusive to T Mobile, I really do. The sad thing is that I've been on two different networks and somehow firms seem to get hold of my mobile number and start calling me offering me an upgrade. The most accurate firm was one who had my full Orange account details, so why wouldn't you trust a firm who knows where you live? When I reported this to Orange they acted surprised but did absolutely nothing about it, probably because data is flowing far too freely around their organisation. My current provider isn't immune either, around 12 months on my previous contract with O2 I had multiple companies each trying to sell me a new contract. They claim it's just on an autodialer of numbers to call and have no personal information about me. However the fact that someone knows I'm on O2 means enough personal data is leaking.
The entire UK (Is it any different elsewhere?) Mobile Phone industry works on ethical standard that would shame organised crime, among the many abuses I've come across :
* Deceptive tariffs, resulting in unexpectedly large bills, especially the roaming data ( I used to handle the phone admin for a medium sized company, we had a user come back from overseas trips with bills up over a thousand pounds when the free roaming data the salesman told us we'd bought turned out to have a fair use limit of 10MB...)
* The reverse billing text message scam - some of the companies operating this make tens of millions, and have been fined hundreds of thousands for repeated abuses - they are still in business.
* your bank details get passed on and you are billed for insurance you never asked for
* BUYING the stolen data
Think of these guys as a bit like Chris in the Sopranos, They got impatient and wanted a piece of the action for themselves. They may get a slap on the wrist, but the business is full of worse criminals.
So.. who actually bought the stolen records if T-mobile employees sold them to other operators but no other operators were involved?
Ans: Third party phone retailers (or, at least, their employees). Not the sort that sell SIM-free phones, the sort that act as agents for the networks and mostly sell phones on contract.
At least, that's who I was getting cold-called by when my T-Mobile contract ran out. Of course, they did their best to use weasel words to imply that they were calling from T-Mobile without actually saying so.
I assume that the game was to try and get you to sign a new T-Mobile contract with them as agent, so they would get the commission.
In a survey of 100 programmers, 111111 thought that duck-typing was a good idea.
Interestingly, some of the UK mobile operators have bankers licences and are therefore governed by the FSA (financial services authority). The FSA defines a PEP marker (Politically Exposed Person) on records and these typically have greater sensitivity than the rest and each access is audited. Anyone who thinks they are 'famous' can become a PEP on request - politicians, david beckham's, recognised government officials, company execs are using this device more and more.
Whilst it might seem like a good idea to register yourself as a PEP (e.g. I'm famous on slashdot), it can be a pain in the arse because some banks etc will not send out new credit cards directly to a PEP.
Using alias's is illegal if done incorrectly. Using an alias as a "stage name" is OK for celebs, but not so great for politicians. Also, it's not a great idea to buy a phone contract with an (!deedpoll) alias.
Contact the ICO and find out if your data was included in the sold information.
Then sue T-Mobile for not protecting your personal data.
Then after the court cases, sue the T-Mobile staff who stole the data, the brokers who sold the data, and the other network operators who bought the data.
T-Mobile customers could if they play this right make a tidy sum of money from sueing the people involved. Remember to get in early before the other customers and ex-customers clean up.
Of course the real way to handle this is to put a price (say, minimum annual contract price x number of customers) and then use **AA accounting methods and sue those involved for copyright infringement of the data :-)