Cyber criminals has collected customer data of aleading digital communications company O2 and sold them on the dark net.According to the Victoria Derbyshire programme the sold information was out.O2 has reported about the theft to the police, and the inquiry is on process.
Three years ago, an attempt was made to log onto to O2 accounts by using username and password stolen from gaming website XSplit. Once if the login details matched the criminals can access O2 customer data where the process is known as “Credential stuffing”.
O2 has reported the case to the law of enforcement and sought help to inquire. It is a technique used to enter into other company’s accounts too.
Hacker selling 32 Million leaked Twitter accounts on the dark web
The news website says “Nothing is fool proof” as the whole data is for sale which includes user phone numbers, emails, passwords and date of births. Darknet is only visible to people using specialist web browsers. It is used for illegal activity.
Credential stuffing is an attack used to breach username or password to fraudulent to gain access to the user account which is a subset of brute force. Please see the following fig.
Hasnain Shaw, from Chester, was one of the people whose details we obtained. His data had already been used elsewhere to access more accounts.
“I was away from home when eBay contacted me to say there was some suspicious activity on my account. I checked, and it looked like there were cars for sale on my account.
Facebook Messenger to get “secret conversations” encryption tool later this summer
“Four weeks ago, I got a similar email from Gumtree. It looked like the same people had got access to that account because it was the same cars being advertised.”
He said he had used the same email address and password for both these accounts and the one with O2 but has since changed them. Before this happened, he had considered himself secure online and internet-savvy.
“I am considering using a password manager and two-step authentication, although nothing is foolproof,” he added.
O2 said in a statement: “Credential stuffing is a challenge for many businesses. We have reported all the details passed to us about the seller to law enforcement, and we continue to help with their investigations.
“We act immediately if we are given evidence of personal credentials being taken from the internet and used to try and compromise a customer’s account.”