Vodafone Australia has hacked a Fairfax journalist’s phone

The Telecommunications giant Vodafone denies ‘improper behaviour’ after its employee accessed Natalie O’Brien’s phone records to discover its sources.

Vodafone Australia has admitted it hacked a journalist’s phone records for espionage purpose. The company was trying to discover the sources for journalist’s stories, but Vodafone denies any “improper behaviour”.

The journalist is Natalie O’Brien and in 2011 she published a series of stories related serious security issues in the Siebel data system used by the Vodafone.

O’Brien reported that Vodafone’s Siebel data system was available online and easily accessible through generic passwords that were being shared around the company and publicly.

The journalists reported that the Vodafone system was vulnerable to cyber attacks, exposing customer data, including home addresses, drivers’ licenses and credit card details, to criminal rings.

In response, after the publishing of the story, a Vodafone employee accessed her phone (O’Brien was Vodafone customer) call and text message records in order to discover its sources and the alleged company whistleblowers.

“It’s a creepy nauseating experience to know that someone has been trawling through your mobile phone account looking at all your call records and private text messages.” O’Brien wrote on the Sun-Herald

“The invasion of privacy is devasting. It plays with your mind. What was in those texts? Who were they to? What did they see? What did they do with the information?” 

The journalist was disconcerted by the events, the alleged flaws in the Vodafone system and the hack have to be reported to the Information and Privacy Commissioner and the Australian Communications and Media Authority.

“The shock and anger is only compounded knowing it was because I was doing my job that I was targeted and it was my own telco that was doing it to me. Since when did telling the truth become the wrong thing to do?”

According to internal Vodafone email, reported by the Australian, the Giant was aware of the serious security breaches and of consequences for hacking the journalist’s communications and data.

“The head of fraud management and investigations for Vodafone Group, Colin Yates, wrote to then global corporate security director Richard Knowlton that there was a “huge risk” to the company if the hacking of O’Brien’s phone “gets into the public domain”.reported the Guardian. 

“If the issue relating to breaching the reporter’s privacy by searching her private call records and text messages gets into the public domain, this could have ­serious consequences given it is a breach of the Australian Telecommunications Act,” Yates wrote.

“And would certainly des­troy all of the work done by VHA [Vodafone Hutchison Australia] over the past months to try and restore their reputation.”

Vodafone denies any allegations of improper behaviour and confirms it provided all the necessary support to the Privacy Commissioner’s investigation.

[Vodafone] “strongly denies any allegations of improper behaviour. VHA takes its legal and corporate responsibilities very seriously”. states the company in an official statement.

“Over the past four years, VHA has invested heavily in the security of its IT systems. The company has very strict controls and processes around the privacy of customer information, and has appointed a dedicated privacy officer. The privacy of our customers and protection of their information is our highest priority and we take this responsibility very seriously.”

“We deny that Vodafone Hutchison Australia made any incorrect statements to the Privacy Commissioner or any other authorities.”

Vodafone confirmed it became aware of the hacking of O’Brien’s phone in June 2012.

“Vodafone Hutchison Australia immediately commissioned an investigation by one of Australia’s top accounting firms. The investigation found there was no evidence VHA management had instructed the employee to access the messages and that VHA staff were fully aware of their legal obligations in relation to customer information.”

This isn’t the first time that Vodafone was cited by privacy advocates.

In June 2014, Vodafone issued the “Law Enforcement Disclosure Report“ that revealed the existence of secret wires that allow state surveillance. The document  describes the support provided by the company to many governments for lawful interception for some of its 400 million customers.

In November 2013, Vodafone Iceland suffered a major data breach that exposed 70000 user personal information. A a group of hackers disclosed a compressed 61.7MB rar file that contained a collection of files including one titled users.sql that appears to contain the 77,000 Vodafone user accounts. The file includes usernames, social security numbers, encrypted passwords as many other encrypted information.

Another file, MySQL file greind.sql appears to contain a small log of sms history that is dated 2011 as well as a sms logger.

The hack of the Fairfax journalist’s phone represents a serious threat for the user privacy, let’s wait for further information of the investigation of Australian authorities.

Pierluigi Paganini

(Security Affairs – Vodafone, hacking)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

Google: China dominates government exploitation of zero-day vulnerabilities in 2023

Google's Threat Analysis Group (TAG) and Mandiant reported a surge in the number of actively…

5 hours ago

Google addressed 2 Chrome zero-days demonstrated at Pwn2Own 2024

Google addressed two zero-day vulnerabilities in the Chrome web browser that have been demonstrated during…

17 hours ago

INC Ransom stole 3TB of data from the National Health Service (NHS) of Scotland

The INC Ransom extortion group hacked the National Health Service (NHS) of Scotland and is threatening…

21 hours ago

CISA adds Microsoft SharePoint bug disclosed at Pwn2Own to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds a Microsoft SharePoint vulnerability disclosed at the…

1 day ago

The DDR Advantage: Real-Time Data Defense

This is the advantage of Data Detection and Response (DDR) for organizations aiming to build…

1 day ago

Finnish police linked APT31 to the 2021 parliament attack

The Finnish Police attributed the attack against the parliament that occurred in March 2021 to…

1 day ago

This website uses cookies.