skip to Main Content

At The Identity Organisation, we're here to help!

    Your privacy is important to us, and we want to communicate with you in a way which has your consent and which is in line with UK Law on data protection. As a result of a change in UK law on 25th May 2018, by providing us with your personal details you consent to us processing your data in line with current GDPR requirements.

    Here is where you can review our Privacy & GDPR Statement

    To remove consent at any time, please e-mail info@tidorg.com with the word "unsubscribe" as the subject.

    +44 (0) 1628 308038 info@tidorg.com

    Telecom Company Responsible for Routing Billions of Text Messages Annually Acknowledges Multi-Year Breach

    Telecom Company Annual Breach

    Mentioned in passing as part of a Securities and Exchange Commission (SEC) filing, Syniverse admits to hackers having access for five years, potentially impacting millions of mobile phone users worldwide.

    In the middle of a recent 837-page SEC filing, telecom company Syniverse mentioned to shareholders of a 2016 data breach that was only discovered earlier this year. Under the topic of how breaches, lapses in data privacy, and other damages to IT operations could impact Syniverse’s business operations, Syniverse acknowledged the 2016 breach flippantly, presenting it merely as “an example.” From the filing (emphasis is mine):

    For example, in May 2021, Syniverse became aware of unauthorized access to its operational and information technology systems by an unknown individual or organization (the “May 2021 Incident”). Promptly upon Syniverse’s detection of the unauthorized access, Syniverse launched an internal investigation, notified law enforcement, commenced remedial actions and engaged the services of specialized legal counsel and other incident response professionals. Syniverse has conducted a thorough investigation of the incident.

    The results of the investigation revealed that the unauthorized access began in May 2016. Syniverse’s investigation revealed that the individual or organization gained unauthorized access to databases within its network on several occasions, and that login information allowing access to or from its Electronic Data Transfer (“EDT”) environment was compromised for approximately 235 of its customers. All EDT customers have been notified and have had their credentials reset or inactivated, even if their credentials were not impacted by the incident. All customers whose credentials were impacted have been notified of that circumstance.

    It’s not clear exactly how hackers were able to compromise the Syniverse network, but, for perspective, I’ve covered how the average dwell time for recent ransomware attacks is 13 days – whereas the Syniverse breach lasted 3 years (1825 days)!!! The filing does mention “All customers whose credentials were impacted have been notified of that circumstance,” which denotes that credentials were compromise and lateral movement is likely.

    The potential access gained, data exfiltrated, systems misused, and damage done is incalculable – despite Syniverse’s claims that “there was no attempt to monetize the unauthorized activity.” Cyber forensics is only as good as the logging that exists and whether the threat actor worked to delete their trail.

    This attack is a reminder that the best position in a data breach is to be so well-protected the breach never happens. And, given it took Syniverse’s IT team 5 years to even identify the attack, it’s also a reminder that your security strategy needs to include detection and remediation, in addition to prevention and protection.


    Request A Demo: Security Awareness Training

    products-KB4SAT6-2-1

    New-school Security Awareness Training is critical to enabling you and your IT staff to connect with users and help them make the right security decisions all of the time. This isn’t a one and done deal, continuous training and simulated phishing are both needed to mobilize users as your last line of defense. Request your one-on-one demo of KnowBe4’s security awareness training and simulated phishing platform and see how easy it can be!

    PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/one-on-one-demo-partners?partnerid=001a000001lWEoJAAW

    close

    Sign Up to the TIO Intel Alerts!

    Back To Top