Vodafone UK was subject to an attempt to access some customers’ account details between midnight on Wednesday 28 October and midday on Thursday 29 October. At that point we initiated a comprehensive investigation to fully understand the facts so that we could give any affected customers the best possible advice. We informed the National Crime Agency (NCA), the ICO and Ofcom of the issue on the evening of Friday 30 October.
This incident was driven by criminals using email addresses and passwords acquired from an unknown source external to Vodafone. Vodafone’s systems were not compromised or breached in any way.
Whilst our security protocols were fundamentally effective, we know that 1,827 customers have had their accounts accessed, potentially giving the criminals involved:
The customer’s name;
their mobile telephone number
their bank sort code
the last 4 digits of their bank account
Our investigation and mitigating actions have meant that only a handful of customers have been subject to any attempts to use this data for fraudulent activity on their Vodafone accounts.
No credit or debit card numbers or details were obtained. The information obtained by the criminals cannot be used directly to access customers’ bank accounts. However, this information does leave these 1,827 customers open to fraud and might also leave them open to phishing attempts.
These customers’ accounts were all blocked on Friday evening and the affected customers have been contacted directly over the weekend to assist them with changing their account details. We have already contacted the banks of affected customers to alert them to the situation and they are following established procedures in order to protect customers. We will also be loading customers’ details into the Credit Industry Fraud Avoidance Service (CIFAS) database, which will ensure that bank or mobile operators will make additional checks to avoid fraud.
We are now working with the NCA in support of their ongoing investigation.
We would like to make clear that only the 1,827 customers, who have all been contacted, have been affected by this incident: no other customers have been affected or need to be concerned, as the security of our customers’ data continues to one of our highest priorities.
About Vodafone UK
Vodafone is one of the world’s largest telecommunications companies and provides a range of services including voice, messaging, data and fixed communications. Vodafone has mobile operations in 26 countries, partners with mobile networks in 55 more, and fixed broadband operations in 17 markets. As of 30 June 2015, Vodafone had 449 million mobile customers and 12 million fixed broadband customers. For more information, please visit: www.vodafone.com.
Vodafone UK partners with businesses of all sizes - from start-ups and small businesses to the largest corporates and the public sector. The company has worked with UK businesses for over 30 years, starting out as a mobile provider and becoming one of the UK’s leading total communications partners. It provides a range of voice and data services, secure communications infrastructure, fixed and call centre capability, unified communications and was the first mobile phone operator to offer a truly converged service for fixed and mobile.
Vodafone is currently spending around £1 billion on its network and services across the UK following a similar amount spent last year. This includes £200 million on its network in London, the introduction of its 4G service to more than 642 cities and towns, as well as thousands of smaller communities whilst also making network improvements across its UK 3G network. Meanwhile, The Vodafone Rural Open Sure Signal programme is also aiming to bring 3G coverage for the first time to 100 remote communities across the UK.
Vodafone House, The Connection, Newbury, Berkshire RG14 2FN, England
Vodafone UK Media Relations
Telephone: +44 (0) 1635 666777
Registered Office: Vodafone House, The Connection, Newbury, Berkshire RG14 2FN
Registered in England No: 1471587