Hackers arrested in Three mobile upgrade scam

TalkTalk breach

News of the data breach at Three comes just six weeks after the Information Commissioner’s Office issued a £400,000 monetary penalty against mobile operator TalkTalk for a data breach in October 2015.

Information commissioner Elizabeth Denham said TalkTalk had failed to apply “the most basic cyber security measures”, leaving its database of nearly 157,000 customers vulnerable to an SQL injection attack after failing to apply a fix for a software bug that had been available for more than three years.

“For years, the industry has said the ‘insider threat’ is the biggest risk to organisations,” said Chris Hodson, European CISO at security firm Zscaler. “This is a case in point. While it is conceivable that user credentials were obtained through social engineering, swift arrests suggest a chain of associated events can likely be traced and compromise comes from insider intent.

“Three might say it is OK that payment details weren’t accessed, but frankly who cares? It doesn’t mean that other confidential data can’t be used to build a false customer profile or commit subsequent fraud at scale.”

Hodson said the breach should serve as a reminder that strong authentication mechanisms and detection controls are essential.

“Of course prevention is ideal, but it’s not always possible,” he said. “We must find ways to reduce the time from initial breach through to identification.”

Compromised credentials possibility

Ryan O’Leary, vice-president, Threat Research Centre at WhiteHat Security, also believes there is a strong possibility that an employee has had his or her credentials compromised.

“This could have been caused by a direct attack, where the attacker attempted to steal the credentials of a specific user, or by using compromised credentials from an entirely different data breach,” he said.

Thomas Fischer, threat researcher and security advocate at Digital Guardian, said insider threats are almost always preventable if the right people management processes and tools are in place, even if an external party has compromised a legitimate user’s account.

“There are numerous technologies out there designed to combat insider threats and small investments can go a long way,” he said. “Deploying data-aware cyber security solutions removes the risk of a hacker with legitimate access to the data because they are prevented from copying, moving or deleting it without approval.”

Duty of care

Paul Lyden, vice-president Northern Europe at Barracuda Networks, said: “All businesses have a duty of care to ensure they have robust security systems in place to protect their own and their customers’ data.

“The latest hack against Three highlights that not enough is being done to get the correct security procedures and systems in place.”

According to Lyden, the world is entering a “golden age for digital crime” because businesses have injected change at accelerating speed into all elements of IT.

“As a result, many organisations are fighting an increasingly challenging battle to keep their security stable,” he said. “It has now become easy for attackers to find an unprotected door.”