Telecom companies have recently become an increasingly popular source of targeting for cyber criminals. Although there is much public attention on targeting banks or healthcare facilities, telecommunication retailers have a special combination of unique personal, financial and identifiying data that makes them extremely valuable in the underground data economy.
An example of this threat was highlighted with the Mobilelink data breach where unauthorized individuals gained access to sensitive customer information and exposed how much information these organizations accumulate behind the scenes. Telecommunications retailers are more than just selling devices and plans; they are collecting and maintaining comprehensive customer profiles which often include copies of identity documents and payment data as well as numerous personal details of their customers.
Telecommunication colmpanies have become a target for many of these reasons but one of the main reasons that they continue to be targeted as a source of identity verification. Typically when a customer signs up for mobile service, they are required to provide official identification, social security number and financial information. This, in turn, creates a central repository that contains a wealth of information that can be easily utilized to commit identity theft/fraud.
Additionally, telecom data has the potential to facilitate more serious types of cybercrime. Cybercriminals can use stolen data to perform SIM swapping, obtain two-factor authentication verification codes and eventually access bank accounts, email services and social media accounts. For this reason, breaches within telecom companies can be especially dangerous as they create opportunities to access many different systems.
The recent breach at Mobilelink is indicative of a continuing trend in which cybercriminal organizations who perpetrate breaches are making public announcements of responsibility for those breaches and threatening to release the stolen data for public consumption; this creates additional pressure on the targeted organization to respond promptly. This also changes how we consider cyberattacks, transitioning from silent intrusions to highly visible events with immediate reputational consequences.
The final explanation for telecom retailers' vulnerability to cyberattacks is their expansive customer base and geographically dispersed business operations. Telecom retailers have multiple retail locations, sales personnel and different technology systems supporting customer data; therefore, maintaining consistent security practices poses significant challenges. Therefore, if one compromised avenue exists into the company's data, then this ultimately increases the risk of a larger-scale breach.
The effects of these kinds of breaches on consumers can be grave, as stolen financial and personal information can be used to commit fraud, steal people's identities, and conduct targeted scam activity. Further, since many telecom accounts connect to other forms of digital media, the fallout from any of these breaches can reach places well beyond the breach itself.
Despite the above, many people tend to take the importance of securing their telecom-related data lightly, as the vast majority of consumers do very basic things to keep their telecom accounts secure, such as using PINs, checking account activity and avoiding shady text messages; all of which will help limit their risk of exposure. Increasing awareness of the issue is fundamental in reducing the overall impact of any future breaches.
Telecom companies will continue to be at the forefront of how individuals communicate and consumer data will continue to be a sought-after commodity for those looking to do wrong; therefore, as the world continues to rely on technology and connectivity, telecom companies will continue to be targets for cyber criminals looking to harvest valuable information. Events such as the Mobilelink data breach serve as a reminder that cybersecurity is not limited to the industries that are commonly viewed as sensitive; businesses outside of those traditional boundaries are just as likely to become targets as any other organization that handles personal data.
To safeguard that data, we must implement both secure organizational systems as well as ensure that consumers are using their own protective behaviours. If we do not combine these, we put ourselves at risk by allowing our telecom platforms to remain entry points for cybercrime as the internet becomes more interconnected.
