Hackers claim to have hit T-Mobile. Is user data being held ransom?
Is it a hoax? T-Mobile, the mobile network operator, isn't saying.
But on Saturday, an anonymous hacker announced that T-Mobile "has been owned for some time. We have everything, their databases, confidental [sic] documents, scripts and programs from their servers, financial documents up to 2009." The hacker first aired the claim on insecure.org, an online reference guide which publishes "low-level packet crafting methods used by advanced hackers," according to a description posted on the site.
"We already contacted [sic] with their competitors and they didn't show interest in buying their data," the hacker wrote on insecure.org, "probably because the mails got to the wrong people – so now we are offering them for the highest bidder. Please only serious offers, don't waste our time." The author then listed an email address, hosted by safemail.net.
As of this afternoon, T-Mobile had neither confirmed nor denied the hacker's claim. "The protection of our customers' information, and the safety and security of our systems, is absolutely paramount at T-Mobile," the company said in a statement. "Regarding the recent claim, we are fully investigating the matter. As is our standard practice, if there is any evidence that customer information has been compromised, we would inform those affected as soon as possible."
Precedent
But as a reporter for CIO Today writes, T-Mobile does have cause for concern. "Not only are a number of the database names listed highly confidential – customer billing, profiles, etc. – but the company has been hacked before," Frederick Lane notes. In 2004, 21-year-old Nicolas Jacobsen broke into T-Mobile servers, where he monitored US Secret Service e-mail and downloaded sensitive information such as Social Security numbers, addresses, and personal photos.
And just last month, a hacker broke into the Virginia Prescription Monitoring Program, and demanded a ransom in exchange for user files. "In my possession right now," that hacker wrote, "are 8,257,378 patient records and a total of 35,548,087 prescriptions. Also, I made an encrypted backup and deleted the original. Unfortunately for Virginia, their backups seem to have gone missing, too. Uhoh: (For $10 million, I will gladly send along the password."
The Virginia case is still being investigated.
