Poured your info out on a call to 118 118 Money? Bad luck. Credit provider 'fesses up that hacker nabbed customer service phone recordings
(2020/03/30)
- Reference: 1585574045
- News link: https://www.theregister.co.uk/2020/03/30/118_118_money_call_recordings/
- Source link:
The digital burglary at 118 118 Money exposed recordings of customer service calls that included a raft of personal information although thankfully not payment data.
As [1]revealed last week , the parent company of the personal loans and credit card provider – the sister business of the better-known UK directory enquiries service – pulled its website offline after spotting an unauthorised intruder.
At the weekend, it wrote to customers again to inform them that a person or persons were identified on its network on 20 March and "recordings of customer service calls were accessed by the criminals responsible for the cyber attack".
"For those customers who have called our customer service line, certain pieces of personal data could potentially be affected," the letter continued. "This could include your name, address and date of birth or other personal information that was discussed as part of the call with our customer service team."
Given the data was contained in the form, "it would be extremely time consuming for anyone to attempt systematically to extract or copy your personal information."
So that's OK then. Of course, the company is sorry for the incident and takes "the protection of your confidential and personal information extremely seriously".
118 118 Money said the database itself was not broken into, and "as soon as we became aware of the situation, we took the immediate step of taking our network offline and working with cyber security experts to ensure the security of both our network and data." ®
The Information Commissioner's Office was notified of the breach and a report was dispatched to the National Cyber Security Centre for further probing.
The website remains out of service a week after it was pulled offline on 23 March.
"We are making every effort to reintroduce our services and will provide full access to our Mobile App and services as soon as possible," the letter to customers added.
Despite saying there is a "low risk to your data being used fraudulently", 118 118 Money offered customers "complimentary access" to Experian's Identity Plus ID fraud monitoring service for 12 months.
The business warned customers that phishing scammers may contact them via the phone or web, and that any such attempts should be reported to Action Fraud. ®
[1] https://www.theregister.co.uk/2020/03/24/got_yuor_number_maybe_118/
As [1]revealed last week , the parent company of the personal loans and credit card provider – the sister business of the better-known UK directory enquiries service – pulled its website offline after spotting an unauthorised intruder.
At the weekend, it wrote to customers again to inform them that a person or persons were identified on its network on 20 March and "recordings of customer service calls were accessed by the criminals responsible for the cyber attack".
"For those customers who have called our customer service line, certain pieces of personal data could potentially be affected," the letter continued. "This could include your name, address and date of birth or other personal information that was discussed as part of the call with our customer service team."
Given the data was contained in the form, "it would be extremely time consuming for anyone to attempt systematically to extract or copy your personal information."
So that's OK then. Of course, the company is sorry for the incident and takes "the protection of your confidential and personal information extremely seriously".
118 118 Money said the database itself was not broken into, and "as soon as we became aware of the situation, we took the immediate step of taking our network offline and working with cyber security experts to ensure the security of both our network and data." ®
The Information Commissioner's Office was notified of the breach and a report was dispatched to the National Cyber Security Centre for further probing.
The website remains out of service a week after it was pulled offline on 23 March.
"We are making every effort to reintroduce our services and will provide full access to our Mobile App and services as soon as possible," the letter to customers added.
Despite saying there is a "low risk to your data being used fraudulently", 118 118 Money offered customers "complimentary access" to Experian's Identity Plus ID fraud monitoring service for 12 months.
The business warned customers that phishing scammers may contact them via the phone or web, and that any such attempts should be reported to Action Fraud. ®
[1] https://www.theregister.co.uk/2020/03/24/got_yuor_number_maybe_118/
Amazon Turk
Dan 55
And job done.
Got your number... name... address... e-mail...
"118 118 Money said the database itself was not broken into"
joeW
So just the place where they dump the data files. Anyone want to put money on them deciding to use an S3 storage bucket?
Please change your name, address and date of birth...
Flak
... and you will be fine. Honestly.
Easy!
12 months?
Andy 97
The types of 'pond life' which accessed this personal data, certainly won't stop attempting to gain goods and services after just 12 months.
If I were a 118 customer, I'd be attempting to find a Rottweiler-like lawyer to mount a class action and annihilate them.
How can such f*ckwittery still be happening?
Is there an acronym...
Klimt's Beast Would
... for events like these?
How about DAWOL - DAta WithOut Leave? Anyone have a better idea?
Icon: Prince Barin (from Flash Gordon) recovering his book of acronyms from a tree stump.
118 118
118 118 Got your data!
[Pun on their TV adverts for those not in the UK]