Massive Giffgaff Privacy Breach

There is a massive privacy breach that directly affects all of you, so I'm here to: 1) Raise awareness 2) Demand that giffgaff change their polic...

kirbz · 2012-01-25T09:32:09+00:00

There is a massive privacy breach that directly affects all of you, so I'm here to: 1) Raise awareness 2) Demand that giffgaff change their polic...

Massive Giffgaff Privacy Breach

turkeyphant

@pinkcalculator wrote:
Lifted this bit from the Engadget app
Update: We received confirmation from O2, who said that it was "investigating with internal teams and it's our top priority." Slashgear and Think Broadband were unable to replicate the problem, but in our tests (pictured) it was sharing our data with the site.

I thought TB did confirm it?

turkeyphant

@hc_1540 wrote:
Personally I'm really not bothered by this at all. I am seeing zero impact from this 'massive security breach' and I suspect a lot of the people here who are up in arms haven't been impacted either. Surely there are more important things to spend your time worrying about?

And by the way, this is an O2 issue and should always be referred to as such. While gg uses the O2 network, it has no responsibility for the pieces of kit that are causing this to happen.

The impact hasn't happened yet! Now website know that they have two years of logs link customers' number with their mobile operator AND their browsing habits. The exploits are huge from phishing to spam to whatever. Just because you haven't been affected yet doesn't mean nobody will nor that you won't be.

And by the way, GG choose the O2 network. They are responsible for due diligence. If your headtecher employed a peado in your kids school, would they not be to blame?

adsyrah

Well this has royally pissed me off.

GG need to let us know what they're doing to 'rectify' this. Is there anything they can do other than moan to O2?!

jms0

A very small number of people may be very badly affected, but may not know it yet. Suppose that a potential employer managed to connect a candidates phone with a website offering support for those with drug or alcohol problems. I can't see them getting the job, regardless of what the law says. What if a blogger, writing critically about their employer, was to be identified? There is the potential for real harm.

Giffgaff sells O2's services, and shouldn't be able to hide behind O2. As giffgaff users we can only complain to (or sue if necessary) giffgaff. It's for giffgaff to take things further with O2.

vorb

Disappointed to read about this.

craig_t

Good afternoon,

We're currently aware of an issue where mobile number information could be being shared in HTTP headers when browsing the mobile internet through headers on your 3G service.

At giffgaff, the privacy and security of our customers is our utmost concern. We are investigating the reports of what appears to be an O2 network issue as a priority, and will be back to you here as soon as we hear anything more.

This has been raised and commented on by us in parts of the community already, so we're starting this thread so you can all pull your discussion together into one place, and also get updates from us from one location too.

Kind regards,

--craig

---

**Update - 13:34**

In order to collate discussion on this, we've merged a longer running thread from this morning into this one.

Any posts you see here from before 12:26 are from this previous thread - posts after 12:26 were made in response to the original post above.

Our latest update is that O2 are investigating this and are aiming to fix the problem as soon as possible.

Unofficial Update -

We've had some reports on this thread from customers that they are no longer seeing this occur. As others are saying this is still occuring for them, we are continuing to ask for information on this and will update as soon as we hear more.

Kind regards,

--craig

**Update - 16:26**

O2 have confirmed via their blog that this was resolved as of 14:00 today. So, this information should no longer be being shared.

The full text of the blog is shared below, along with a link.

We will continue to investigate for further information, and update when we have any ifnormation relevant to giffgaffers - so will leave the thread open for the time being for this purpose.

Kind regards,

--craig

http://blog.o2.co.uk/home/2012/01/o2-mobile-numbers-and-web-browsing.html#more

Quoted Text From O2 Blog

25 January 2012

O2 mobile numbers and web browsing

Security is of the utmost importance to us and we take the protection of our customers’ data extremely seriously.

We have seen the report published this morning suggesting the potential for disclosure of customers’ mobile phone numbers to website owners.

We investigated, identified and fixed it this afternoon. We would like to apologise for the concern we have caused.

Below is a set of Q&As, to answer questions we've been receiving. If you have further questions, do leave them in the blog comments and we will do our best to answer as many as possible.

Q: What's happened with O2 mobile numbers when I browse the internet on my mobile?

A: Every time you browse a website (via mobile or desktop), certain technical information about the machine you are using, is passed to website owners. This happens across the internet, and enables website owners to optimise the site you see. When you browse from an O2 mobile, we add the user's mobile number to this technical information, but only with certain trusted partners. This is standard industry practice. We share mobile numbers with selected trusted partners for 3 reasons: 1) to manage age verification, which manages access to adult content, 2) to enable third party content partners to bill for premium content such as downloads or ring tones that the customer has purchased 3) to identify customers using O2 services, such as My O2 and Priority Moments. This only happens over 3G and WAP data services, not WiFi.

Q: How long has this been happening?

A: In between the 10th of January and 1400 Wednesday 25th of January, in addition to the usual trusted partners, there has been the potential for disclosure of customers’ mobile phone numbers to further website owners.

Q: Has it been fixed?

A: Yes. It was fixed as of 1400 on Wednesday 25th January 2012.

Q: Which of my information can website owners access?

A: The only information websites had access to is your mobile number, which could not have been linked to any other identifying information we have about customers.

Q: Why did this happen?

A: Technical changes we implemented as part of routine maintenance had the unintended effect of making it possible in certain circumstances for website owners to see the mobile numbers of those browsing their site.

Q: Which customers were affected?

A: It affected customers accessing the internet via their mobile phone on 3G or WAP services, but not WIFI, between 10th of January and 1400 on Wednesday the 25th of January.

Q: Which websites do you normally share my mobile number with?

A: Only where absolutely required by trusted partners who work with us on age verification, premium content billing, such as for downloads, and O2's own services, have access to these mobile numbers.

Q: The Information Commissioner said he is investigating - what are you doing as part of this?

A: We are in contact with the Information Commissioner's office, and we will be co-operating fully. We have also contacted OFCOM.

kungfusi

great to hear that the good people are giffgaff are getting on to this so we can all have peace of mind 🙂

as7861

@Craig_t

Thanks for the update 😉

Could people also be advised not to contact agents about this ?

(asking)

pinkcalculator

Can the other threads be merged and added to this one they are all over the place

craig_t

@pinkcalculator wrote:
Can the other threads be merged and added to this one they are all over the place

On it.

pinkcalculator

Other thing could O2 be asked to give an official comment on the matter to be posted here as its their error and their issue and they need to have a presence here it shouldn't just be left to gg to clean it all up, I would also say the same for Tesco users too.

darrenpainter

Interesting that this all kicks off today, just as the EU proposes an overhaul of Data Protection laws 🙂

http://www.bbc.co.uk/news/technology-16722229

styly

@pinky

An official statement from O2 accepting responsibility?
Ever the optimist eh? Haha

pinkcalculator

There's already lots of replies to tweets on twitter from O2 so why not to the companies they supply

as7861

@craig_t

Another thing that maybe linked -

According to this website -

http://lew.io/headers.php

Which states

"To answer some questions and responses I've seen - no, it's not anything client-side. O2 seem to be transparently proxying HTTP traffic and inserting this header.
Another annoying feature of O2 is that they interfere with the responses from servers too. They downgrade all images and insert a javascript link into the HTML of each page. I've talked to customer service about this lovely feature several times, but they never have a clue what I'm talking about, let alone any idea how to opt out/disable it. "

Someone has already investigated that does not work for o2 😉

Maybe interesting to look into 🙂

up_the_saddlers

@craig if your so concerned about privacy etc why not turn data off until this issue is sorted?

cbh1948

@hc_1540 wrote:

And by the way, this is an O2 issue and should always be referred to as such. While gg uses the O2 network, it has no responsibility for the pieces of kit that are causing this to happen.

Are you absolutely sure about that? I understand that the problem ultimately rests with o2; however, as I've mentioned in previous posts, I very much doubt that giffgaff can contract out of its obligations to us under the Data Protection Act. They would have to take reasonable steps to show that they had reason to believe that our information was being protected. Of course, o2 will inturn be liable to giffgaff.*

* I'm not a lawyer (although do have a legal background) and do not have any firm knowledge of the DPA. However, from some of the links I have posted it does look as though giffgaff are responsible to its customers.

b0fh

up_the_saddlers - turning off data is not an acceptable course of action for people who reply on it. "two wrongs don't make a right".

As I've already said on Twitter I am happy that GG is chasing things up themselves, however the fact that this has happened at all is totally unacceptable. Whichever company/individuals (not likely) re responsible should be hung out to dry (also not likely, but it's what should happen)

oldyorkie

Update on Sky News 30mins ago ....

Data protection watchdog, the Information Commissioner's Office said in a statement: "When people visit a website via their mobile phone they would not expect their number to be made available to that website.

"We will now speak to O2 to remind them of their data breach notification obligations, and to better understand what has happened, before we decide how to proceed."

We watch and wait ... but ultimately 02 to blame and not gg until can be proved otherwise...

I'm not too concerned ...yet...

acesabe

http://www.gladdy.co.uk/mobile/ enuf said! 😉