800,000 customers’ data stolen at French Orange Telecom

Orange-signThe world’s largest mobile operator Orange was compromised by a massive data breach on January and stole  800,000 customer records. The attack  appears to have affected 3% of the population.  Orange has since reported  PCInpact that  “My Account” portal on the website was hacked and added that three percent of customers (that’s approximately 800,000) were compromised.”

The stolen information includes names, postal and email address, as well as phone numbers both landline and cellphone. The password passwords were not affected but the company has urged its users to change their password in an email sent out to affected customers. Tim Holman, CEO of 2-sec and president of ISSA UK, pointed to Orange’s spotty record in regard to data breaches (the firm also suffered a huge email data breach in 2010), and said that the attack is likely “some sort of SQL injection”.

“The anatomy of the attack appears to be something wrong with the “My Accounts” page, for French customers, which suggests some sort of SQL injection attack being used to exfiltrate hundreds of thousands of customer records,” as told by Tim to SCMagazineUK.com.

“Given the volume of exposed records, then SQL injection is very likely, as opposed to cross site scripting, broken authentication/session management.” as told to the media reports.

More details here

Share Button
Tagged with 

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title="" rel=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>