Swisscom data breach: 800,000 customers affected

Video: Uber breach impacted 380K Singapore users

Swisscom has revealed its customer data systems have been compromised and information belonging to roughly 800,000 customers has been stolen.

The Worblaufen, Switzerland-based firm said on Wednesday that customer names, addresses, telephone numbers, and dates of birth were exposed due to the breach, which took place in late 2017.

Under the country's laws, this data is considered "non-sensitive" and there is no evidence that financial information was compromised.

Swisscom says that its systems were not hacked, but rather, the "misappropriation of a sales partner's access rights" led to information disclosure using valid credentials for illegal purposes.

The majority of those affected are mobile subscribers together with a handful of fixed network customers. According to the telecommunications provider, the information stored is required when a subscription agreement is reached and sales partners are given "limited access" to this data to "enable them to identify and advise customers and conclude or amend contracts with them."

While the information is protected by specific user logins and passwords, as a sales partner's own system was compromised -- and this may have given an attacker these credentials -- the security barrier was broken.

Swisscom uncovered the data breach in a routine check of systems. The sales partner has not been named and the identities of the threat actors behind the theft are yet to be unmasked.

As a result of the security incident, Swisscom intends to tighten its security for non-sensitive customer information.

"Swisscom stresses that the system was not hacked and no sensitive data, such as passwords, conversation or payment data, was affected by the incident," the company says. "Rigorous long-established security mechanisms are already in place in this case."

See also: CT, MRI machines face the greatest risk of cyberattack, researchers warn

Swisscom reported the incident to the Federal Data Protection and Information Commissioner (FDPIC) and has blocked the offending sales partner from accessing the firm's systems. In addition, the company intends to introduce tighter controls in the future.

Customers can check to see if their information was compromised by sending an SMS with the word "Info" to 444.

5 things you should know about VPNs

Previous and related coverage

Hacking suspect Lauri Love wins landmark appeal against US extradition

The 33-year-old previously said he feared dying in prison overseas.

ADB.Miner worm is rapidly spreading across Android devices

Updated: The malware is targeting and compromising thousands of devices to mine cryptocurrency.

Cryptocurrency miners: A replacement for ransomware

Attackers are turning away from ransomware in favor of fraudulent cryptocurrency mining -- and your IoT devices might be their future cash cows.