Vodafone data breach: 56K accounts exposed
Severity: high · Patch status: no-fix-needed · Since 2013-11-30
In November 2013, Vodafone in Iceland suffered an attack attributed to the Turkish hacker collective "Maxn3y". The data was consequently publicly exposed and included user names, email addresses, social security numbers, SMS message, server logs and passwords from a variety of different internal sources. Exposed data: credit cards, email addresses, government issued ids, ip addresses, names, passwords, phone numbers, physical addresses, purchases, sms messages, usernames. The breach dates from Nov 30, 2013; Have I Been Pwned loaded it on Nov 30, 2013.
What to do
- If you had a Vodafone account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
