The world’s largest mobile operator Orange was compromised by a massive data breach on January and stole 800,000 customer records. The attack appears to have affected 3% of the population. Orange has since reported PCInpact that “My Account” portal on the website was hacked and added that three percent of customers (that’s approximately 800,000) were compromised.”
The stolen information includes names, postal and email address, as well as phone numbers both landline and cellphone. The password passwords were not affected but the company has urged its users to change their password in an email sent out to affected customers. Tim Holman, CEO of 2-sec and president of ISSA UK, pointed to Orange’s spotty record in regard to data breaches (the firm also suffered a huge email data breach in 2010), and said that the attack is likely “some sort of SQL injection”.
“The anatomy of the attack appears to be something wrong with the “My Accounts” page, for French customers, which suggests some sort of SQL injection attack being used to exfiltrate hundreds of thousands of customer records,” as told by Tim to SCMagazineUK.com.
“Given the volume of exposed records, then SQL injection is very likely, as opposed to cross site scripting, broken authentication/session management.” as told to the media reports.
More details here
