The Data Breach allows hackers to hijack the victim’s SIM card, personal data and phone number
US-based biggest wireless network operator T-Mobile & AT&T has reported a massive data breach in which the personal information of millions of its users, including phone numbers, e-mail addresses and account numbers, were exposed to hackers.
The carrier said three percent of its customers were affected or about two million to 2.5 million of its 77 million customers. As Buzzfeed reported two major flaws that could’ve revealed PIN numbers for customers of T-Mobile and AT&T.
In T-Mobile’s case, an “engineering mistake” between Apple’s online storefront and T-Mobile’s account validation API allowed for an unlimited number of attempts on an online form, which would allow a hacker to use unlimited no of chances to guess an account PIN or the last four digits in a customer’s social security number, in what’s called a brute-force attack.
As the report mentions, once they find the right one, it could allow someone to take the number and then use it to hijack a victim’s SIM card and phone number. Once you have that, it’s easy to hack any service that relies on text messages to send two factor-authentication codes as a primary method or backup.
For AT&T, a similar vulnerability occurred on one of the pages where customers could file insurance claims via Asurion that asked for a PIN, but allowed unlimited attempts and did not put any limit on the rate.
However, Apple and Asurion told Buzzfeed News that the issues have been fixed now that they’ve been brought to their attention. All affected customers have been, or shortly will be, notified, said the T-Mobile company.