The company says that financial information wasn’t compromised, but other sensitive information has been stolen.
It’s been a relatively quiet month for data breaches this month compared to January. Of course, it’s trivially easy for a month to be quiet compared to January when data breach stories were coming out on more than a weekly basis.
In January, 1 billion records were exposed in the Aadhaar data breach. This follows the 20,000 customers exposed in the SinVR data leak. From there, 2.9 million Norway medical records were exposed to hackers. An additional 100,000 Bell customers had their data exposed in Canada. An additional 2 million accounts were exposed in the Jason’s Deli data breach. Finally, 3 Android Sega games which have been downloaded up to 600 million times had data leaking to uncertified servers. Suffice to say, January was a very rough month on the security front.
That brings us to the latest data breach. This time, 800,000 accounts have been exposed. The affected organization is Swisscom, an Internet Service Provider (ISP) in Switzerland. From ZDNet:
The Worblaufen, Switzerland-based firm said on Wednesday that customer names, addresses, telephone numbers, and dates of birth were exposed due to the breach, which took place in late 2017.
Under the country’s laws, this data is considered “non-sensitive” and there is no evidence that financial information was compromised.
Swisscom says that its systems were not hacked, but rather, the “misappropriation of a sales partner’s access rights” led to information disclosure using valid credentials for illegal purposes.
The majority of those affected are mobile subscribers together with a handful of fixed network customers. According to the telecommunications provider, the information stored is required when a subscription agreement is reached and sales partners are given “limited access” to this data to “enable them to identify and advise customers and conclude or amend contracts with them.”
While the information is protected by specific user logins and passwords, as a sales partner’s own system was compromised — and this may have given an attacker these credentials — the security barrier was broken.
The report goes on to say that the partner in question and the unauthorized party responsible for the breach are not identified. However, the incident was reported to Federal Data Protection and Information Commissioner (FDPIC).
The bad news here clearly is that this is the latest breach we are aware of this month. Indeed, there are plenty of people who are affected by this. The good news is that it could have been much worse because financial information was unaffected by this. Still, one can only imagine the affected customers reaction when they were notified that some of their information was compromised to begin with.
Drew Wilson on Twitter: @icecube85 and Google+.
