Russian Megafon posts thousands of customer SMS to the open Web

When Google was just getting started and some companies didn't have enough experience to keep their customer data really private, all kinds of interesting things used to end up on the Web. Including personally identifiable information, medical records and credit card numbers.

Eventually things did get better, but sometimes we still get an interesting data breach or two. And today we got a major one.

Somehow, Russian mobile operator Megafon managed to get at least some of it's customer SMS - complete message texts, tied to the actual phone numbers - in to the index of Russian search engine Yandex.ru. If you type a certain query "url:www.sendsms.megafon.ru* | url:sendsms.megafon.ru*" into a search box there private customer SMS start popping up.

The amount of the messages made public does not seem to be very big. Yandex search returns 8765 results for the query, and, given the total amount of SMS going out on your average mobile network, that's probably a fractions of a percent of the total.

But the nature of the breach - full text of the SMS and the mobile number from which it was sent - makes this one really bad. A quick skim of the results shows tons of "I love you" notes, break-up messages, gossip about others and what not, which could cause a lot of grief to the sender if seen by someone else.

The messages that made it into Yandex, were sent via Megafon's SMS Web Interface sendsms.megafon.ru

Update: Megafon admitted to SMS leak, confirming that no phone-to-phone messages were leaked. Which means that SMSs sent only via Megafon Web interface were affected. According to Megafon, the “situation is now under control” and leaked information has now been removed fro Yandex. However there are reports that users are still finding public SMS messages in regional Yandex caches in some parts of Russia.

Hat tip to @eldarmurtazin
source: Unwired View

Related Post:

News

• ChevronWP7 officially closes up shop for good, hands out App Hub memberships
• Verizon expands 4G LTE coverage in the West
• Plume for Android Update Adds ICS Elements
• UC Browser 8.2 for Android takes a crack at the US market
• Safely Phone Controls on Android announced
• Sony CEO Kaz Hirai to reveal new strategy on April 12th
• AT&T 4G LTE Coming to Bloomington, IN and Bryan-College Station, Texas April 8th
• Google acquires TxVia in an effort to expand Google Wallet
• Instagram for Android Now Available!
• PayPal Here Launches in Canada, Google Earth for Android and iOS Reaches Version 6.2 & Sparrow Launches Email Client for iOS With Gorgeous UI