Mobile network Three UK's customer details exposed in homepage blunder
Mobile operator Three UK's website was showing visitors other customers' names, postal addresses, phone numbers, email addresses and more – all without asking for a login.
Alarmed Reg reader Chris immediately tweeted at Three to ask what on Earth was going on, querying why Three's site was displaying different people's data to him every time he changed page.
The site was showing him as logged in even though he'd only gone to the mobile operator's homepage.
"When you load their site over your mobile internet connection, it recognises you and automatically logs you in," Chris told us. "I was doing this on my home Wi-Fi (which isn't Three), so it should've required me to log in manually when I first went to their site. I guessed it might've either redirected me to a session for a valid user who was accessing at the same time, or some blip which didn't recognise me and just assigned another user's ID instead."
"I wasn't able to to view any payment details – card or direct debit, and I wasn't able to load any detailed bills to view itemised activity," added Chris. Three claims to have around 10 million registered subscribers.
While our reader waited for a response from Three (it replied to him on Twitter an hour and a half after his initial tweet), he tipped off El Reg. As we investigated, we noticed the company website went down for a little while with the standard "under maintenance" page displayed – and came back up again after about an hour. Chris said other people's data was no longer visible once the site returned.
The nature of the data breach suggests that potentially the entire customer database along with some of the personal data held on file may have been exposed.
Despite repeated contact with Three's PR representatives, none of The Register's questions about the potential size or scale of the breach have been answered.
Judging by the URLs visible in some of the other screenshots Chris sent us, which included the letters /new, the company's techies may have accidentally deployed an under-construction revamp of the site to the mobe firm's production servers. This is merely speculation and Three has not responded to questions on this.
The Information Commissioner's Office was unable to say, at the time of publication, if Three had reported the breach.
An ICO spokesperson told us: “Three has made us aware of an incident and we will be making enquiries.”
A Three UK spokesperson told us: “A small number of customer[s] have reported an issue to us regarding my3. We have blocked access to my3 while we investigate the issue.”
Three UK wanted to make it known that only four people had complained about being able to view any random Three customer's personal data by simply visiting its website and not even needing to log in. El Reg is very happy to make this clear.
source theregister
Latest Jobs
-
- Senior Penetration Tester - UK - Ability to achieve security clearance.
- United Kingdom
- To attract the right person
-
Senior Penetration tester, who has the ability to achieve security clearance. (Visa sponsorships NOT available - sorry) UK based - remote first - occasional travel. Red teaming experience desirable. The successful person needs to have a history of engaging directly with customers (consultancy experience) technical delivery of penetration tests AND report writing. Limited travel - company operates a remote first approach. Must be living in the UK. Not one of the usual names in the pen testing industry. Looking for someone highly technical but looking to grow and develop their skills. Apply here or Reach out to me on chris.holt@dclsearch.com or 07884666351 All details kept discreet
-
- Cloud Architect- German Speaker
- Hungary
- Upto €48000 per year + bonus + benefits
-
As a Senior Pre-Sales Solutions Architect, you will play a pivotal role in driving our sales success by translating complex technical solutions into compelling proposals that resonate with our clients. You will collaborate closely with our sales teams to understand customer needs, design tailored solutions, and negotiate successful deals. Responsibilities: Solution Design: Develop comprehensive technical solutions that align with customer business objectives and industry best practices. Proposal Development: Create compelling proposals, including requirements gathering questionnaires, presentation materials, and Statements of Work (SOWs). Customer Engagement: Build strong relationships with clients, understanding their technical, business, and commercial requirements. Collaboration: Work closely with sales teams, delivery teams, and third-party partners to ensure successful project execution. Pricing Strategy: Define and deliver pricing strategies that align with customer needs and company objectives. Requirements: Experience in technical pre-sales or sales support roles. Proven track record in designing and delivering successful customer solutions. Strong technical foundation in areas such as VMware, Azure, AWS, cloud computing, and data center technologies. Excellent understanding of sales principles, account management, and negotiation techniques. Ability to explain complex technical concepts clearly and concisely. Experience working in international teams and supporting clients across multiple regions. Fluency in German and English is essential. Benefits: Competitive salary and benefits package Opportunity to work on challenging and rewarding projects Collaborative and supportive work environment Potential for career growth and advancement Please note that this role is focused on supporting German clients, but will also involve global client support as needed.
-
- Solution Architect - OUTSIDE IR35 - Contract- SC / DV - London
- London
- OUTSIDE IR35
-
Solution Architect For a London based Contract This is an Outside IR35 project. MUST have a minimum of an ACTIVE - SC clearance and be willing to be put through DV clearance. 6 month rolling Immediate Experience delivering technical Security Architecture design / assurance of security design. Cross domain experience desirable HLD / LLD London commutable Immediately interviewing.
-
- Microsoft Sentinel Architect
- Netherlands
- discussed on applications
-
Microsoft Sentinel Architect We're seeking a talented and experienced Microsoft Sentinel Architect to be responsible for the design, deploy of a new Sentinel solution into an expanding Services business. As a key member of our team, you'll play a vital role in driving security operations and protecting clients' assets. Responsibilities: Solution Design:Develop comprehensive Microsoft Sentinel architectures aligned with our clients' specific needs and industry best practices. Deployment and Configuration:Oversee the deployment and configuration of Sentinel components, including data connectors, analytics rules, and playbooks. Integration:Integrate Sentinel with other security tools and platforms within our MSSP ecosystem. Tuning and Optimization:Continuously monitor and optimize Sentinel performance to ensure maximum effectiveness and efficiency. Training and Mentoring:Mentor junior team members and provide training on Sentinel technologies and best practices. Required Skills and Experience: Proven experience as a Microsoft Sentinel Architect with a deep understanding of its capabilities and limitations. Strong technical skills in Azure, security operations, and data analytics. Experience designing and implementing complex security solutions, into a services environment Knowledge of threat intelligence, incident response, and compliance frameworks. Excellent communication and problem-solving skills.