Incident & Breach Response
,
Security Operations
Data Leaked from a Thrid-Party Vendor
U.S. wireless telecom USCellular says a data breach at a third party vendor resulted in a leak of 52,000 named and email addresses.
See Also: Live Webinar | Navigating the Difficulties of Patching OT
The company confirmed that data from the leak is available for download on a criminal data breach forum. The regional carrier serves roughly 5 million customers with its largest geographical spread of wireless coverage located in the American Midwest.
The hacker behind the breach did not directly target UScellular’s system but obtained data through a third-party service provider, a spokesperson for UScellular told Information Security Media Group.
“We have been made aware of a recent security incident at a former third-party vendor resulting in unauthorized access to now out-of-date UScellular customer data. Our relationship with this third-party vendor was for a limited time,” the spokesperson added.
The data set is freely available for download on a popular hacker forum as seen by the Information Security Media Group. A user under the moniker “IntelBroker” listed the entire data set of 144,000 entries with a disclaimer for those interested in downloading the data stating: it consists of multiple duplicate records that need filtering.
The spokesperson told ISMG that the data included names, email addresses and other account information but not the social security numbers, credit card numbers, or other sensitive data.
The data set published on the hacker forum does include other sensitive information like customer subscriber ID, subscriber and account keys, account activation date, device manufacturer and model, account balance, and whether the user is enrolled in autopay and/or has an insurance policy on their device.
In December 2021, a breach exposed UScellular’s customer and employee data (see: UScellular: Hackers Accessed Customer Data).
UScellular’s spokesperson said the two incidents are unrelated.
