Telefónica: Data breach affects thousands of employees and customers

Telecommunications company Telefónica has confirmed a breach of its internal systems, which led to the breach of customer and employee data.

Four cybercriminals posted a Jira database on a hacking forum, according to screenshots shared on X. The hackers claimed that the database contains 236,493 lines of customer data, 469,724 lines of internal ticketing data , and over 5,000 internal PDF, Word, PowerPoint, and other documents.

According to Wire Tor, three of the perpetrators appear to belong to the Hellcat.

See also: Medusind: Data breach affects 360,000 people

“We have become aware of unauthorized access to an internal ticketing system,” Telefónica admitted. “We are currently investigating the extent of the incident and have taken the necessary measures to prevent any unauthorized access.”

Hudson Rock says it has spoken to the perpetrators, who explained that they used phishing malware to infect more than 15 Telefónica employees, stealing their credentials and gaining access to the company's systems.

The hackers then appear to have used social engineering to expand their access.

«Specifically, they targeted two employees with administrative privileges, tricking them into revealing the correct server for brute-forcing SSH access. This multi-faceted approach highlights the evolving complexity of cyber threats.».

Hudson Rock claimed that the breach exposed the emails and names of 24,000 Telefónica employees and 500,000 Jira issues and summaries. The latter could reveal sensitive business details and vulnerabilities in Telefónica's infrastructure.

See also: Washington sues T-Mobile over 2021 data breach

Hudson Rock also claimed that the 5,000 internal documents that were stolen “likely contain” confidential information about strategic plans and internal communications, which could further compromise the telecommunications company’s security.

The telecommunications industry has been the target of many hacking groups in recent years.

Telecommunications companies: Protecting networks from cyberattacks

Telecommunications companies can protect their networks from cyberattacks by taking some protective measures.

The first and perhaps most critical step is education. Attacks are increasing in frequency and complexity, so it's important for everyone in the company to be informed and understand the risk. Regular training and seminars can help provide this information. Employees should learn the signs of a phishing attack and other tactics used by attackers.

Regularly updating and upgrading software and devices is another important measure to prevent cyberattacks. Out-of-date systems are more vulnerable to attacks.

Next, companies need to use advanced systems security. These systems include intrusion detection and intrusion prevention, and the use of reliable antivirus software is also important.

See also: Casio: Data breach of 8,500 people

Additionally, companies can use encryption to protect data transmitted over their networks. Encryption converts data into a form that can only be decoded with a special key.

Telecom companies can also implement access policies to limit who can access networks . This can include requiring access credentials, two-factor authentication, and monitoring user behavior.

Using a firewall and VPN can also be very useful, as well as creating backups to restore stolen or locked files.

Finally, network segmentation is necessary so that an attack cannot spread to all of a company's systems.

Most importantly, however, it is important to remember that no one is completely safe. Anytime a system connects to the internet, there is always some degree of risk. However, with proper preparation and implementation of security best practices, telecommunications companies can reduce the risk of cyberattacks and keep their networks secure.

Source: www.infosecurity-magazine.com