Home   News   Article

O2 customer data being sold to criminals on dark net, investigation finds




O2 customer data including phone numbers, emails, passwords and dates of birth, is being sold by criminals on the dark net.

The data was almost certainly obtained by using usernames and passwords first stolen from gaming website XSplit three years ago to log onto O2 accounts, the BBC’s Victoria Derbyshire programme has learned.

When the login details matched, the hackers could access O2 customer data in a process known as “credential stuffing”.

O2 says it has reported the case to police, and is helping the inquiry.

It is highly likely that this technique will have been used to log onto other companies’ accounts too.

All the O2 account holders whose details the BBC has seen have been informed, with many saying they had used the same login for other online accounts.

O2 said in a statement: “We have not suffered a data breach. Credential stuffing is a challenge for businesses and can result in many company’s customer data being sold on the dark net.

“We have reported all the details passed to us about the seller to law enforcement and we continue to help with their investigations.”



COMMENTS
()


Iliffe Media does not moderate comments. Please click here for our house rules.

People who post abusive comments about other users or those featured in articles will be banned.

Thank you. Your comment has been received and will appear on the site shortly.

 

Terms of Comments

We do not actively moderate, monitor or edit contributions to the reader comments but we may intervene and take such action as we think necessary, please click here for our house rules.

If you have any concerns over the contents on our site, please either register those concerns using the report abuse button, contact us here.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies - Learn More