Mobile network Three UK's customer details exposed in homepage blunder
Mobile operator Three UK's website was showing visitors other customers' names, postal addresses, phone numbers, email addresses and more – all without asking for a login.
Alarmed Reg reader Chris immediately tweeted at Three to ask what on Earth was going on, querying why Three's site was displaying different people's data to him every time he changed page.
The site was showing him as logged in even though he'd only gone to the mobile operator's homepage.
"When you load their site over your mobile internet connection, it recognises you and automatically logs you in," Chris told us. "I was doing this on my home Wi-Fi (which isn't Three), so it should've required me to log in manually when I first went to their site. I guessed it might've either redirected me to a session for a valid user who was accessing at the same time, or some blip which didn't recognise me and just assigned another user's ID instead."
"I wasn't able to to view any payment details – card or direct debit, and I wasn't able to load any detailed bills to view itemised activity," added Chris. Three claims to have around 10 million registered subscribers.
While our reader waited for a response from Three (it replied to him on Twitter an hour and a half after his initial tweet), he tipped off El Reg. As we investigated, we noticed the company website went down for a little while with the standard "under maintenance" page displayed – and came back up again after about an hour. Chris said other people's data was no longer visible once the site returned.
The nature of the data breach suggests that potentially the entire customer database along with some of the personal data held on file may have been exposed.
Despite repeated contact with Three's PR representatives, none of The Register's questions about the potential size or scale of the breach have been answered.
Judging by the URLs visible in some of the other screenshots Chris sent us, which included the letters /new, the company's techies may have accidentally deployed an under-construction revamp of the site to the mobe firm's production servers. This is merely speculation and Three has not responded to questions on this.
The Information Commissioner's Office was unable to say, at the time of publication, if Three had reported the breach.
An ICO spokesperson told us: “Three has made us aware of an incident and we will be making enquiries.”
A Three UK spokesperson told us: “A small number of customer[s] have reported an issue to us regarding my3. We have blocked access to my3 while we investigate the issue.”
Three UK wanted to make it known that only four people had complained about being able to view any random Three customer's personal data by simply visiting its website and not even needing to log in. El Reg is very happy to make this clear.
source theregister
Latest Jobs
-
- Sailpoint IIQ Consultant
- London
- Up to £75,000
-
SailPoint IIQ consultant- London We are looking for a strong SailPoint IIQ consultant to work for this global enterprise, in this position you will be the lead consultant in regard to the IAM and PAM tools Duties include Responsible for designing, developing, testing, implementing, and integrating IAM (SailPoint) systems and solutions. Assessing requirements for Identity and Access Management solutions to meet stakeholders needs. Provide support for production IAM infrastructure systems and processes. Ensures the maintenance, patching, operating, and monitoring of IAM systems. Ensures senior management and staff are informed of any changes and updates in a timely manner. Experience with Maintaining and supporting SailPoint IIQ Assessing requirements for Privilege Access Management solutions to meet stakeholders needs We are looking for someone with the following experience SailPoint IIQ experience Expertise working with SailPoint Identity IQ platform - Access Lifecycle Management, Certifications, Role Management Expertise in onboarding applications with various connectors like Active Directory, JDBC, SCIM 2.0, Azure Active Directory Expertise in developing APIs (SCIM, REST) leveraging Java based developmentExperience of Privileged Access Management concepts and use cases Unfortunatly we are unable to provide sponsorship for this opportunity, therefore applications will need to be able to work in the UK
-
- SailPoint Consultant- Netherland-
- Netherlands
- upto €700 per day
-
We are looking for a highly skilled SailPoint IIQ Consultant to work on a major deployment project. The ideal candidate will have experience with all aspects of SailPoint IIQ, including development, configuration, and administration. They will also be able to work independently and as part of a team to deliver high-quality results. · Responsibilities · Develop and configure Sailpoint IIQ solutions · Integrate SailPoint IIQ with other systems · Support SailPoint IIQ deployments · Provide technical support to users If you are a highly skilled SailPoint IIQ consultant who is looking for their next project, we encourage you to apply. look forward to hearing from you!
-
- Lead CyberArk deployment Consultant
- London
- Upto £80,000 plus benefits
-
CyberArk Consultant is needed to be responsible for leading the deployment of CyberArk solutions for this expanding IT services business, You will work with customer both pre and post sales, getting involved in CyberArk Solution Design, helping to create CyberArk Strategic Roadmaps, on-boarding accounts, product and process integration into the CyberArk Solution and Proviso of Installation and technical Documentation. We are looking for this individual to have experience in: Installation of CyberArk PAS for V11.X and V12.X (Vault, DR Vault, Central Policy Manager and Password Vault Web Access) Upgrade of CyberArk from V9 and V10 (Vault, DR Vault, Central Policy Manager and Password Vault Web Access) Installation and Upgrade of Privilege Session Manager and Privilege Session Manager Proxy As some of your client will be government site, all individual will need to be put through SC clearance, therefore you must be eligible to receive this and happy to be put through(With a British Citizen or to have lived in the UK for the past 5 years) We are unable to provide work visa sponsorship for this opportunity
-
- Senior Business Analyst - Outside IR35 Contract, SC Clearance Required, London
- London
- £400 per day outside IR35
-
Senior Business Analyst - Outside IR35 Contract, SC Clearance Required, Based in London Project- to engage with colleagues and stakeholders to investigate and model business functions, processes, information flows and data structures, using a range of business analysis techniques. • You will translate the solution to the business problem into detailed requirements by creating user stories and well-defined acceptance criteria. • Elicit end-to-end business requirements for a live cross-government service • Working across the Government departments to bring together varied business and operational outcomes to form a holistic overall set of service requirements Current SC clearance is required. As is the ability to travel to London.