US cellular community operator (MVNO) Mint Cellular has confirmed that it’s affected by an information breach affecting an unknown variety of its prospects.
The corporate revealed the information in an electronic mail despatched to its prospects, explaining “We’re writing to tell you of a safety incident we lately recognized during which an unauthorized actor obtained some restricted sorts of buyer data.”
“Our investigation exhibits that sure data related together with your account was affected.”
SIM swap assault
Among the many information stolen have been customers’ full names, telephone numbers, electronic mail addresses, together with SIM serial numbers and IMEI numbers, and temporary descriptions of the cellular plans the shopper had bought.
Cost data was not stolen, the agency mentioned, including that buyer passwords are protected with “robust cryptographic expertise” and hinting (however indirectly saying) that some passwords may have been taken. Whereas we do not know who attacked Mint or how (if it was a social engineering assault, malware or ransomware), the corporate mentioned it “fastened the breach” and introduced in third-party safety specialists to tighten up the programs.
Info similar to individuals’s names, electronic mail addresses, and telephone numbers is sufficient to launch just a few sorts of assaults, from id theft to phishing, Web fraud, and extra. Nonetheless, BleepingComputer claims that whoever obtained the info now has sufficient data to run SIM swapping assaults – basically redirecting individuals’s GSM communications to an endpoint of their alternative.
That means, they’ll redirect SMS messages used for one-time passwords (OTP) or multi-factor authentication (MFA) and acquire entry to even probably the most safe accounts (assume financial institution accounts or comparable).
TechRadar Professional has reached out to Mint Cellular for additional clarification.
The information is the second such incident to have an effect on the corporate, after cybersecurity researchers from FalconFeeds beforehand discovered a hacker attempting to promote a Mint database on the darkish internet — although it is unclear whether or not or not this was a separate incident.
Through BleepingComputer