French telco loses 800k customer records to hackers

Orange France has confirmed its 'My Account' portal was hacked in mid-January with around 800,000 customers impacted.

French media reported the breach by unknown attackers on January 16. The flaw is said to have been closed within hours.

My Account contains personal information such as name, postal and email address, as well as phone numbers.

Although passwords were not affected, the company has nonetheless urged users to change them anyway as a precaution.

One of the main risks of such a breach is that criminals could use the stolen details to carry out further attacks, such as spear-phishing attacks or phishing attacks to steal more sensitive information, such as banking credentials.

Tim Holman, CEO of 2-sec and president of ISSA UK, pointed to Orange's spotty record in regard to data breaches (the firm also suffered a huge email data breach in 2010), and said that the attack is likely “some sort of SQL injection”.

“The anatomy of the attack appears to be something wrong with the "My Accounts" page, for French customers, which suggests some sort of SQL injection attack being used to exfiltrate hundreds of thousands of customer records,” he told SCMagazineUK.com.

“Given the volume of exposed records, then SQL injection is very likely, as opposed to cross site scripting, broken authentication/session management.”

Brian Honan, founder and analyst at BH Consulting, concurred that the issue likely arose due to vulnerability on the Orange website.

This article originally appeared at scmagazineuk.com