- Freedom Mobile suffered a supply chain breach via a subcontractor account, exposing customer PII
- Stolen data includes names, addresses, dates of birth, telephone numbers and account numbers; passwords and payment information unaffected
- The company warns of phishing risks; no evidence of data leak yet, investigation underway
Canadian telecommunications provider Freedom Mobile recently suffered a supply chain attack in which it lost sensitive data on an as yet undisclosed number of customers.
In a data breach notification letter posted on its website earlier this week, Freedom said hackers breached an account at a subcontractor, through which they gained access to personal information “about a limited number” of its customers. The breach was discovered on October 23 and access was terminated.
But by the time the compromised account was blocked and sanitized, hackers managed to steal people’s full names, mailing addresses, dates of birth, phone numbers (both home and mobile) as well as Freedom Mobile account numbers.
Phishing warning issued
While the telco emphasizes that payment information and passwords were not obtained in the attack, the threat actors stole more than enough information to launch highly destructive phishing attacks.
For example, they could reach out to Freedom Mobile customers, pretending to be the carrier, and threaten account termination unless victims immediately log in (via a fake login page that steals credentials) or download a program (which is actually malware). Such an email, paired with personally identifiable information, could sound credible to recipients and therefore could result in compromise.
At press time, no threat actors claimed responsibility for the attack, and Freedom Mobile found no evidence that the data is leaking into the wild. Still, users are advised to be wary of incoming messages, especially those that claim to be from the telco and that have a sense of urgency. “Freedom Mobile will never ask you for personal information such as credit card numbers, bank details, passwords or PINs via email or SMS,” the notice reads.
Founded in 2008 as Wind Mobile, Freedom Mobile currently has more than two million customers across Canada. It was purchased by Vidéotron in 2023, bringing the total number of subscribers to over 3.5 million.
Via Bleeping Computer
The best antivirus for all budgets
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews and opinions in your feeds. Be sure to click the Follow button!
And of course you can too follow TechRadar on TikTok for news, reviews, video unboxings, and get regular updates from us on WhatsApp also.
