Mint Mobile data breach allowed attacker to port phone numbers

Carrier Mint Mobile has revealed it was the victim of a data breach, one which allowed a number of customer phone numbers to be ported out to another carrier, along with possible access to subscriber data.

An email sent on Saturday to affected customers by Mint Mobile discloses there was a breach of the carrier's systems. The breach, which occurred between June 8 and June 10, reveals a "very small number of Mint Mobile subscribers' phone numbers were affected by the incident.

According to Mint, phone numbers associated with the accounts were "temporarily ported to another carrier without permission," reports Bleeping Computer. Mint also admits the attacker may have gained access to some account information, including names, phone numbers, email addresses, passwords, and account numbers.

Mint did not say how the breach took place, but it is likely to have been a compromise of an application used by customer service agents. The carrier does advise customers who receive the email to change their account password, and to be vigilant of other accounts that uses the phone number for two-factor authentication purposes.

The attack on the carrier is the latest to demonstrate the need for high security for customer-facing support systems. In late June, Microsoft confirmed that the hacking group thought to be behind the SolarWinds breaches used a compromised customer service agent's computer to steal information, data later used to attack Microsoft's customers.

Keep up with everything Apple in the weekly AppleInsider Podcast — and get a fast news update from AppleInsider Daily. Just say, "Hey, Siri," to your HomePod mini and ask for these podcasts, and our latest HomeKit Insider episode too.

If you want an ad-free main AppleInsider Podcast experience, you can support the AppleInsider podcast by subscribing for $5 per month through Apple's Podcasts app, or via Patreon if you prefer any other podcast player.

14 Comments

mobird 758 comments · 20 Years

About 3 years ago

What is to be accomplished by porting numbers out to another carrier from the standpoint of the attacker?

genovelle 1481 comments · 16 Years

mobird said:

What is to be accomplished by porting numbers out to another carrier from the standpoint of the attacker?

If they have other identifying information like name etc they could get past account resets requiring access to the phone to receive texts for 2 level verification. Like accessing bank accounts

StrangeDays 12964 comments · 8 Years

Damn sorry to hear that, but glad we weren’t affected.

We switched to Mint (owned by Deadpool actor Ryan Reynolds) and are big fans — $15 a month, period. My days of paying AT&T $160 got 2 lines are over… The website is cleaner, the bills are insanely clear, and since I pay annual I don’t even have to worry about the bill every month.

Dumb pipes. That’s what I want.

mpantone 2245 comments · 18 Years

mobird said:

What is to be accomplished by porting numbers out to another carrier from the standpoint of the attacker?

It shows that they --the threat actor -- actually accomplished the data theft. This makes the stolen data more valuable since potential buyers (as well as the rightful owner Mint Mobile) would consider it legitimate.

It is currently unclear if this is a ransomware attack and if the threat actors have demanded compensation from Mint Mobile. But this is one of the typical M.O.s of these type of cybercriminals.

OctoMonkey 332 comments · 4 Years

StrangeDays said:

Damn sorry to hear that, but glad we weren’t affected.

We switched to Mint (owned by Deadpool actor Ryan Reynolds) and are big fans — $15 a month, period. My days of paying AT&T $160 got 2 lines are over… The website is cleaner, the bills are insanely clear, and since I pay annual I don’t even have to worry about the bill every month.

Dumb pipes. That’s what I want.

Last year we switched to Comcast xfinity mobile and are similarly pleased. $15 before taxes and $29.40 after taxes for 5 lines. Plus, adding an additional Comcast service provided a $10 per month service credit to our internet bill, giving us a net $19.40 per month for 5 lines... essentially $4.00 per line per month! To top it off, they gave us $300 in pre-paid Visa cards over the course of the first three months. We left Verizon when we switched, but the Comcast service piggybacks on the Verizon network. No idea how they are making money... or perhaps it shows just how much money Verizon (and their ilk) are siphoning from the pockets of the masses.