Google Fi, Google’s U.S.-only telecommunications and mobile internet service, has notified customers that personal data was exposed by a data breach at one of its primary network providers. Some of them were also warned that it allowed SIM swapping attacks.
The data breach had exposed the customer’s phone numbers, SIM card serial numbers, account status (active or inactive), account activation date, and mobile service plan details.
Google clarified that the breached systems did not hold sensitive details such as full names, email addresses, payment card information, SSNs, tax IDs, government IDs, account passwords, or contents of SMS and phone calls.
There was no access to Google’s systems or any systems overseen by Google.
Google however did not mention who the primary network provider that got breached was, but it is believed that they are referring to T-Mobile.
T-Mobile disclosed last month that it suffered an API data breach in November 2022 that exposed the personal information of approximately 37 million subscribers.
The exposed technical SIM data allowed threat actors to conduct SIM swap attacks on some Google Fi customers.
SIM swapping attacks occur when hackers convince mobile carriers to port a customer’s phone number to a mobile SIM card under the attacker’s control.
These attacks are conducted using social engineering, where the threat actor impersonates the customer and requests that the number be ported to a new device for some reason. They also provide personal information exposed to phishing attacks and data breaches in order to convince the mobile carrier.
Once the number is ported, the threat actors would have access to the victim’s text messages, including MFA codes, allowing them to breach online accounts or take over services secured by a person’s phone number.
Those customers impacted by SIM swap attacks were notified separately by Google, disclosing that the attackers managed to port their numbers to another SIM for a short time. However, users’ voicemail wasn’t breached.
Comments