Slashdot Mirror
Vodafone Customer Database Breached
beaverdownunder writes "Vodafone has confirmed it believes its secure customer database has been breached by an employee or dealer who has shared the access password, revealing the personal details of millions of customers... According to Fairfax newspapers, 'criminal groups are paying for the private information of some customers including home addresses and credit card details.'"
Well this sure sounds like when they need to give somebody access to *some* data, they just give her/him a username/password which then grants her/him access to the whole database.
ACLs ? group based authorization ? For example, very few people should be allowed to view credit card numbers, a representative should only be allowed to view his own customers data, etc.
Kind of like: You are the new guy who is managing our blog ? Here is the root password on all our systems, thanks to yp, they are the same on all machines. Have fun in your new job.
Everything I write is lies, read between the lines.
1234?
I don't try to hide and lock down my car's license plate number. My car's license plate number is 6NHG617. Nobody cares about it and nobody wants to steal it. It's not valuable. The solution to the "problem" of personal identification theft is not to keep trying to hide and lock down personal information. The solution is to make personal information no longer valuable.
WTF is a vodafone?
Neither the summary nor TFA says if this is global or limited to a particular region or one country. At a guess because TFA comes from a .au domain and says nothing about the extent of the issue this only impacts Australian customers of Vodafone?
Never underestimate the dark side of the Source
How the heck do they get away with having retrievable credit card details in their db? Once the CC# is in the database it shouldn't be retrievable.
How many places out there don't actually follow this simple rule?
Where I work we were worried that the banks may turn off our credit card processing facilities if we don't get PCI compliant. And that is maybe 1/40 of the customer base.
I am really puzzled - how does Vodafone get away with this in the first place? No audits?
I don't think you can still call it "secure".
First, make it mandatory to disclaim when a breach occurs, with a criminal penalty (making their management accessory to the crimes in which this breached information may be used). When we'll make companies responsible for the damage they cause, they will be more careful with the information. Actually, I'd expect them to tackle the problem at its source and stop collecting unnecessary information altogether... or implement good security measures.
We have a situation where the cost of acquiring and possessing information is next to nothing, but using it has a value. Let's re-establish the balance by making sure that the cost of possession reflects the reality.
Neat way of selling your database, then claiming it was stolen...
For justice, we must go to Don Corleone
From the Article:
"I'm not concerned about the brand at the moment, I'm mostly concerned about making sure our customers' records are safe."
"And that's why we're resetting those passwords every 24 hours. "
So I guess
Today's password is "password01092011" tomorrow's password is "password01102011" Terminals labels will be changed to password = password + today's date.
Why oh why would Vodaphone give a DEALER the credentials necessary to access " ... the personal details of millions of customers ... "?
OK, everyone...we've been notified...
everybody change their name & move so that the bad guys cannot use this information and we can sit back and laugh at them.
Karma: Excellent. 15 moderator points expire sometime.
This does make me a little nervous... Time to change a few passwords methinks.
Yet another reason to use Prepaid SIMs in my phones. My phone company doesn't even know my full name nor phone model, much less my CC number.
Dilbert RSS feed
Such breaches are the reason why I will never have a credit card. There ought to be a way to create some kind of simple ACL on payment methods: Similar to how I use a different e-mail alias for every (important) website I sign up for which I can simply change or delete if the database is breached or I receive spam, I should be able to give each company an individual authorisation code for withdrawals from my account that can only be used by that company, maybe through digital signatures, and may be subject to further limitations (no withdrawal above x, not more than a total of x withdrawn per month, each requested withdrawal must be manually authorised by me...). So even if one such code was compromised evil haxor X could do nothing with it unless they also steal the same company's payment certificate, which in an ideal world should not be stored on the same machine as their customer DB.
I can fine-tune who can do what on my media server down to ridiculous levels, but I have virtually no control over my bank account. Something is horribly wrong in this world.
Rudolf Hess edited Mein Kampf. He was the very first grammar nazi.
I wonder if this affect only australia or the UK as well (and probably other country where vodaphone are).
C'mon, millions of customers? this is vodafone we're talking about not o2..
Vodafone ought to communicate to each customer if his/hers details have gone awry, and held responsible for any consequences attributable to the breach now and in the future. The industry regulator ought to go in and swiftly smack them around the head. Very, very hard. From board level down to anyone who has any sort of responsibility for this at all. Several times. And land them with a fine that is outrageously high by any standard.
Does anybody know if this was a global database or one region only?
cheers.
This is one reason why I pay by b-pay instead of credit card. My phone number and address are already in the phone book. Not happy about calling info being revealed, but not having the c/c number out there is the main thing.
Wherever possible, I choose a service provider that will take bank transfers of bpay as a payment method rather than automatic billing by c/c. It gives you more control (such as in a dispute over billing they have to try to get the money from you rather than you trying to get it back) and prevents the number being leaked by insecure systems.
They don't know who did it. Was it an employee or a dealer? They don't know; it even says that in the article. So how can Vodafone say this is a "one-off"?
Because he or she hasn't been discovered, the person who did this STILL HAS ACCESS TO THEIR NETWORK.
Fuckers. Don't lie to me directly like that. I'll never trust you again.
Vodafone PR keeps repeating -- both in the press and on their website -- that the information was "not publicly available on the internet" which, although technically true, is disingenuous. What IS being asserted is that the credentials to access the "secure" information were well known.
So much information should never have been made public. As others have remarked, not all the breached information needed to be available online. They also should have had individual log-on's and layered access.
Also, some other systems log user queries for later audit / scrutiny (e.g. the police database here in NSW). Definitely not fool-proof but a deterrent.
"secure customer database has been breached"
(for extremely small values of "secure.")
I Cant log into my account?
I Cant log into my account?
I Cant log into my account?
WTF?!?
My company got sucked into moving several thousand numbers to Vodafone (via Crazy Johns) several years ago, suckered in by cheap prices.
The first month, their whole computer system crashed. They couldn't recover the statements and in the end we got that month for free.
The second month, every single charge on every single statement was overcharged by about 30%-40%. It took 3-4 months to get this sorted out, massively delaying our billing cycle. Eventually we had to issue 3 months of bills within several weeks which caused huge amounts of ill will (towards us, not Vodafone).
By then it had turned out that their billing system wasn't actually capable of processing the phone plan they'd sold us. It literally couldn't compute the fees. So, I had to personally develop custom software (took about 2 days) to make the micro adjustments to each item on the bills before we sent them on, then chase Vodafone for the appropriate refund. Running this internal rerate each month is now a standard part of our billing process.
In the midst of all this fucking stupidity, for about the first year, they were unable to bring up our account on screen because it was so large (kept crashing), so they couldn't effectively respond to our account enquiries.
That's just my own personal direct experience, but more broadly they're recognized as having the worst coverage, they may have a class action coming against them for unreasnoable network drop outs, and now on top of that they've demonstrated deplorable security policies.
Vodafone: you suck at life. Fuck you. Fuck you fuck you fuck you.
1c per kilobyte recently when I went to New Zealand from Australia. Least I got some sunshine though.
Vodafone also owns 45% of Verizon Wireless.
http://en.wikipedia.org/wiki/Verizon_Wireless
"Cellco Partnership, doing business as Verizon Wireless, is a wireless phone provider that owns and operates the largest mobile telecommunications network in the United States, based on a total of 93.2 million U.S. subscribers, 400,000 subscribers ahead of the second largest provider, AT&T Mobility, in Q3 2010.[1] Headquartered in Basking Ridge, New Jersey,[2] the company is a joint venture of U.S. telecommunications firm Verizon Communications and British multinational mobile network operator Vodafone, with 55 and 45 percent ownership respectively."