Hackers may have accessed the bank details of nearly 2,000 Vodafone customers, the company has said.
The mobile phone provider said 1,827 accounts were accessed, potentially providing criminals with customers’ names, mobile numbers, bank sort codes and the last four digits of their bank accounts.
A Vodafone spokesman said: “This incident was driven by criminals using email addresses and passwords acquired from an unknown source external to Vodafone. Vodafone’s systems were not compromised or breached in any way.” The company said an attempt had been made to access some customers’ account details between midnight on Wednesday and midday on Thursday. Vodafone began an investigation and informed the National Crime Agency, Ofcom and the Information Commissioner’s Office on Friday night.
“Whilst our security protocols were fundamentally effective, we know that 1,827 customers have had their accounts accessed, potentially giving the criminals involved the customer’s name, their mobile telephone number, their bank sort code, the last four digits of their bank account,” it said. “Our investigation and mitigating actions have meant that only a handful of customers have been subject to any attempts to use this data for fraudulent activity on their Vodafone accounts.”
No credit or debit card details were accessed and the information obtained by the criminals “cannot be used directly to access customers’ bank accounts”. “However, this information does leave these 1,827 customers open to fraud and might also leave them open to phishing attempts,” the spokesman added. “These customers’ accounts have been blocked and affected customers are being contacted directly to assist them with changing their account details.”
It had contacted the banks of affected customers to alert them. The revelation follows the recent cyber-attack suffered by another telecoms company, TalkTalk, earlier this month. TalkTalk said on Friday that fewer than 21,000 unique bank account numbers and sort codes had been accessed and fewer than 1.2m customer email addresses, names and phone numbers. Fewer than 28,000 obscured credit and debit card details and 15,000 customer dates of birth were also accessed.
The totals are far lower than the company had first feared, but the incident has caused further reputational damage to TalkTalk. The cyber-attack was the third to hit the company in the past eight months, with incidents in August and February also resulting in customers’ data being hacked.
