“T-Mobile customer data” offered by hackers
T-Mobile has confirmed its company servers have been breached by hackers. But it’s still far from certain that a group offering to auction off stolen information really does have everything it claims.
An anonymous source posting on a security mailing list over the weekend claimed to have got their hands on “everything, their databases, confidential documents, scripts and programs from their servers, financial documents up to 2009.” The source said they had offered it to T-Mobile’s rivals but had no interest, so was now inviting bids for the data.
That caused some speculation that the hacker was either playing a hoax or grossly exaggerating how much data they had. A former British detective who specializes in computer security told CNET it was unlikely a genuine criminal would steal so much data without already having a buyer lined up and noted that offering it publicly in such a way would reduce the data’s value as it would tip T-Mobile off, allowing it to change customer passwords.
It’s also notable that the post only contained details of logfiles from the servers, rather than any data. Publishing some example documents would have made the claim much more credible and boosted the interest of would-be buyers.
T-Mobile has now confirmed that the information published by the hackers is a genuine copy of the original logfile. It says possession of this data alone is not enough to pose a security risk to customers. The firm has taken “additional precautionary measures” and is investigating the breach to see how it occurred and if any other data has been stolen.
It’s not yet clear how up-to-date the logfiles are. That detail might help explain whether the people offering the data have hacked into the live system, or whether they’ve got hold of the data physically, for example from a back-up on a machine which had been stolen, lost, or disposed of without being wiped.
Related Posts:
