Article Details

'Limited' data leak at Aussie telco turns out to be 280K customer details. iiNet breach blamed on single stolen login, with emails, phone numbers, and addresses exposed. Aussie telco giant TPG Telecom has opened an investigation after confirming a cyberattack at subsidiary iiNet. It said the "cyber incident" was contained on August 16, and the attackers were ousted from iiNet's systems, but called in outside help to manage the cleanup. Stolen credentials TPG, which acquired iiNet in 2015, said the intrusion took place after the credentials belonging to a single employee were stolen. Cyberattacks begin in various ways, but the abuse of genuine staff credentials is one of the most common, and there are plenty of ways of acquiring the keys to a company's systems. Phishing's prevalence is well-known in the cred-snatching game, but in recent years infostealer malware has emerged as an equally serious threat to organizations.  It's one that global authorities are fighting as vehemently as the likes of ransomware, primarily because the two are so interlinked. A regular precursor to ransomware attacks, infostealers are often spread through compromised websites or phishing emails, and are capable of quietly scooping up usernames and passwords en masse, making them a valuable tool for serious cybercriminals. They're cheap, too. When Dutch cops took down the Redline and Meta infostealers last year, security shops said that budding cybercrooks could pick up a copy of either for as little as $150. At present, the attack is thought to be isolated to iiNet's order creation and tracking system, and contained only "limited personal information." "Limited" is doing a lot of heavy lifting, as the company went on to say that it looks like the attackers copied a trove of active customer email addresses – about 280,000. That doesn't include the approximately 20,000 active iiNet landline phone numbers, or the 10,000 customer usernames, street addresses, and phone numbers, and roughly 1,700 modem setup passwords. An undisclosed number of inactive email addresses and phone numbers were also swiped, TPG said. "We unreservedly apologise to our iiNet customers impacted by this incident," it told [PDF] the Australian Securities Exchange on Tuesday. "We will be taking immediate steps to contact impacted iiNet customers, advise of any actions they should take, and offer our assistance. "We will also contact all non-impacted iiNet customers to confirm they have not been affected. We do not currently have any evidence to suggest an impact to our broader systems or other customers." TPG Telecom operates some of the biggest brands in Australia, and is the second-largest listed telco in the country behind Telstra. In addition to iiNet, it owns Vodafone, Lebara, Internode, Felix Mobile, AAPT, and its eponymous provider, TPG. Per its most recent annual report, it delivers mobile services to 5.51 million subscribers and internet services to 2.08 million across all of its brands.