CyberSecurity news
FlagThis - #Telecom
|
Dysruption Hub@The Dysruption Hub
//
Cellcom, a Wisconsin-based mobile carrier, has confirmed that a cyberattack is the cause of a week-long service outage that began on the evening of May 14, 2025. Customers across Wisconsin and Upper Michigan experienced disruptions to voice and SMS services, leaving them unable to make phone calls or send text messages. Initially, the company attributed the issue to a technical problem but later acknowledged the cyber incident in a video and letter from CEO Brighid Riordan. The attack specifically targeted a network segment responsible for handling voice and SMS, but the company assured customers that sensitive data, such as names, addresses, and financial details, was not compromised.
Cellcom has engaged federal authorities, including the FBI, and international cybersecurity experts to assist in mitigating the impact and restoring full service. CEO Brighid Riordan stated that the company was not unprepared for such an incident and emphasized their commitment to recovery. Partial service has been restored, and the company anticipates a full restoration by the end of the week. Cellcom has also pledged to cover service fees for affected customers during the outage as a gesture of accountability and thanks. The cyberattack on Cellcom highlights the critical importance of cybersecurity and the potential consequences of a breach on essential communication services. The outage has disrupted both personal and business communications, with some customers reporting business losses due to the prolonged downtime. The Wisconsin Department of Agriculture, Trade and Consumer Protection has received at least 15 customer complaints related to the disruption. Cellcom is advising affected users to try turning on their phone’s airplane mode for 10 seconds or restarting their device if they continue to experience connection issues. Recommended read:
References :
Pierluigi Paganini@Security Affairs
//
African multinational telecommunications company, MTN Group, has disclosed a cybersecurity breach that exposed the personal information of some of its subscribers. The breach has raised significant concerns about data security and the potential regulatory and legal repercussions the company may face. MTN operates across various African markets and is therefore subject to stringent national data protection laws, such as South Africa’s Protection of Personal Information Act (POPIA) and Nigeria’s Data Protection Regulation (NDPR). These regulations mandate strict data handling and security measures, with non-compliance potentially leading to substantial fines and legal actions.
MTN's immediate response included collaboration with law enforcement, specifically the South African Police Service and the Directorate for Priority Crime Investigation, underscoring the seriousness of the situation. While MTN has assured stakeholders that its core networks and financial systems remain secure, the incident has nonetheless triggered concerns about the overall robustness of the company's cybersecurity defenses. An investigation is currently underway to determine the full scope and impact of the breach, as the company seeks to understand how the attackers were able to compromise customer data. The breach poses a significant challenge to MTN's brand reputation and customer trust, particularly given its extensive subscriber base of nearly 300 million users. Restoring confidence will require transparent communication with affected customers and the implementation of robust cybersecurity measures to prevent future incidents. The company has already begun notifying impacted customers and is working to comply with all local legal and regulatory obligations. While the precise financial consequences of the breach are still unknown, the incident highlights the growing threat of cyberattacks against telecommunications companies and the critical importance of maintaining strong data protection practices. Recommended read:
References :
@www.ic3.gov
//
The FBI has issued a public appeal for information regarding a widespread cyber campaign targeting US telecommunications infrastructure. The activity, attributed to a hacking group affiliated with the People's Republic of China and tracked as 'Salt Typhoon,' has resulted in the compromise of multiple U.S. telecommunications companies and others worldwide. The breaches, which have been ongoing for at least two years, have led to the theft of call data logs, a limited number of private communications, and the copying of select information subject to court-ordered U.S. law enforcement requests. The FBI is seeking information about the individuals who comprise Salt Typhoon and any details related to their malicious cyber activity.
The FBI, through its Internet Crime Complaint Center (IC3), is urging anyone with information about Salt Typhoon to come forward. The agency's investigation has uncovered a broad and sophisticated cyber operation that exploited access to telecommunications networks to target victims on a global scale. In October, the FBI and CISA confirmed that Chinese state hackers had breached multiple telecom providers, including major companies like AT&T, Verizon, Lumen, Charter Communications, Consolidated Communications, and Windstream, as well as dozens of other telecom companies in numerous countries. In an effort to incentivize informants, the U.S. Department of State’s Rewards for Justice (RFJ) program is offering a reward of up to US$10 million for information about foreign government-linked individuals participating in malicious cyber activities against US critical infrastructure. The FBI is accepting tips via TOR in a likely attempt to attract potential informants based in China. The agency has also released public statements and guidance on Salt Typhoon activity in collaboration with U.S. government partners, including the publication of 'Enhanced Visibility and Hardening Guidance for Communications Infrastructure.' Salt Typhoon is also known by other names such as RedMike, Ghost Emperor, FamousSparrow, Earth Estries, and UNC2286. Recommended read:
References :
Pierluigi Paganini@Data Breach
//
SK Telecom, a major mobile network operator in South Korea, is grappling with the aftermath of a significant cyberattack that compromised the USIM data of approximately 23 million subscribers. The breach, discovered on April 19th, involved malware infiltration that allowed attackers to steal sensitive customer information, including mobile phone numbers and device identification numbers (IMEI). This stolen data poses significant risks to affected users, including potential identity theft and SIM swap attacks, where criminals can hijack a victim's phone number to gain access to personal and financial accounts.
In response to the widespread data breach, SK Telecom has announced a program to provide free SIM card replacements to all 25 million of its mobile customers. This initiative aims to mitigate the risk of SIM swapping and other fraudulent activities by replacing compromised SIM cards with secure ones. However, the company faces logistical challenges, with only 6 million SIM cards available for immediate replacement through May. This shortage raises concerns about the timeline for fully addressing the vulnerability and protecting all affected subscribers. The cyberattack has had a substantial impact on SK Telecom, leading to customer anxiety, a loss in market capitalization estimated at $643 million, and potential subscriber attrition. The South Korean Ministry of Science and ICT and the Korea Internet & Security Agency (KISA) have launched an on-site investigation at SK Telecom's headquarters, signaling the seriousness of the breach and the regulatory scrutiny the company now faces. While SK Telecom is implementing measures to restore customer trust, the incident serves as a wake-up call for the telecommunications industry, highlighting the need for robust cybersecurity practices and proactive security measures. Recommended read:
References :
Pierluigi Paganini@securityaffairs.com
//
A new ransomware group named Arkana Security is claiming responsibility for breaching WideOpenWest (WOW!), one of the largest U.S. cable and broadband providers. Arkana Security also claims the hack of US telco provider WideOpenWest (WOW!). This nascent ransomware gang’s breach purportedly compromised over 403,000 WOW! user accounts, pilfering data, including full names, usernames, salted passwords, email addresses, login histories, and security questions and answers.
The attackers boast of full backend control and have even created a music video montage to demonstrate their level of access. Additionally, they claim to have exfiltrated a separate CSV file with 2.2 million records, including names, addresses, phone numbers, and devices. While WOW! has yet to acknowledge Arkana Security's claims, threat researchers traced the attack's origins to an infostealer infection in September last year that enabled access to WOW!'s critical systems. Recommended read:
References :
|