UK-based phone, TV and broadband services provider Virgin Media on Thursday admitted that it exposed the personal information of roughly 900,000 people.
The company blamed the incident on a misconfigured marketing database that stored names, home addresses, email addresses, phone numbers, and technical and product information. Dates of birth were also exposed “in a very small number of cases.”
“Please note that this is all of the types of information in the database, but not all of this information may have related to you,” customers were told.
Virgin Media said the exposed database did not include any passwords or financial information, such as payment card details or bank account numbers. The database stored information on both customers and potential customers.
The firm said this was not a cyberattack and its database was not hacked. However, its investigation revealed that the database was accessed at least once, although it is unclear if any information was actually taken.
While it is possible that the database was accessed by malicious actors, it’s also not uncommon for security researchers to come across unprotected databases and access them for analysis, particularly if they appear to belong to a major organization.
In a letter sent out to affected individuals, Virgin Media said the database was accessible since at least April 19, 2019, and the unauthorized access occured recently.
Virgin Media claimed it quickly shut down access to the database once it learned of the exposure. The company launched an investigation into the data breach and notified the Information Commissioner’s Office.
Related: T-Mobile Notifying Customers of Data Breach
Related: 400 Mn Facebook Users’ Phone Numbers Exposed in Privacy Lapse: Reports
Related: Canadian Telecom Firm Freedom Mobile Exposed Customer Details
Related: Major U.S. Mobile Carriers Vulnerable to SIM Swapping Attacks
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Industry Reactions to Hive Ransomware Takedown: Feedback Friday
- US Reiterates $10 Million Reward Offer After Disruption of Hive Ransomware
- Hive Ransomware Operation Shut Down by Law Enforcement
- UK Gov Warns of Phishing Attacks Launched by Iranian, Russian Cyberspies
- Dozens of Cybersecurity Companies Announced Layoffs in Past Year
- Security Update for Chrome 109 Patches 6 Vulnerabilities
- New Open Source OT Security Tool Helps Address Impact of Upcoming Microsoft Patch
- Forward Networks Raises $50 Million in Series D Funding
Latest News
- Critical Vulnerability Impacts Over 120 Lexmark Printers
- BIND Updates Patch High-Severity, Remotely Exploitable DoS Flaws
- Industry Reactions to Hive Ransomware Takedown: Feedback Friday
- Microsoft Urges Customers to Patch Exchange Servers
- Iranian APT Leaks Data From Saudi Arabia Government Under New Persona
- US Reiterates $10 Million Reward Offer After Disruption of Hive Ransomware
- Cyberattacks Target Websites of German Airports, Admin
- US Infiltrates Big Ransomware Gang: ‘We Hacked the Hackers’
