Verizon Partner Exposes Data of Millions of Customers Who Called Customer Service [Updated]

Up to 14 million Verizon subscribers may have had their sensitive data exposed by Nice Systems, a partner of Verizon, reports ZDNet. Subscriber records from users who called customer service over the past six months were located on an unprotected Amazon S3 storage server controlled by Verizon partner Nice Systems.

The data, which included customer names, phone numbers, home addresses, email addresses, and account PINs, was accessible to anyone who found what ZDNet says was an easy-to-guess web address. That PINs were made available is concerning as a PIN is what's used to verify a customer's identify and make changes to an account.

The customer records were contained in log files that were generated when Verizon customers in the last six months called customer service. These interactions are recorded, obtained, and analyzed by Nice, which says it can "realize intent, and extract and leverage insights to deliver impact in real time." Verizon uses that data to verify account holders and to improve customer service.

There were six folders for the months between January 2017 and June 2017, which included customer calls from several different US regions. Records included "hundreds of fields of additional data" beyond name, phone number, and PIN, like current account balance, a list of Verizon services, and more. No audio files were found, though the log files were based on calls. Some of the data was masked, but it's not clear what was hidden and what was exposed.

Verizon was informed of the leak in late June and it took more than a week for the information to be secured. Verizon told ZDNet it is investigating how information was improperly stored on the Amazon Web Services server. The company also said the "overwhelming majority" of the data has "no external value" and there's "no indication that the information has been compromised."

"Verizon provided the vendor with certain data to perform this work and authorized the vendor to set up AWS storage as part of this project," said a spokesperson. "Unfortunately, the vendor's employee incorrectly set their AWS storage to allow external access."

Verizon customers who have called in to customer support over the course of the last six months should update their PINs as a precaution.

Update: Verizon released a press statement clarifying that no one accessed the data, so there was no theft or loss of customer information. Verizon also says that only 6 million unique customers were affected and those customers were part of its residential and small business wireline.

Tag: Verizon

Top Rated Comments

(View all)

keysofanxiety

26 months ago

Fake news. None of that information was ever protected in the first place. Literally almost each and every thing about all of us is known - to those who want to know it.

We have no privacy in the digital age, 'hacked' or not. It is all available.

Cool. In which case I'm sure you don't mind publically sharing your full name, phone number, email address and home address with us?

Allowing such information to become available to the public by simply following a URL which wasn't secured is far from "fake news". It's very much real news and very much an oversight that could have been easily avoided.

Rating: 15 Votes

mudflap

26 months ago

Can you hack me now?

Rating: 13 Votes

keysofanxiety

26 months ago

Coincidence that your username is keysofanxiety? I only meant to imply that any fear from this leak is the fake news. Everyone could know your address if they wanted to. Snapchat geocodes you. FB geotags you. Your phone tracks everywhere you go. Even this forum has your IP address and could make a discernible guess as to your location. Take pictures? The EXIF data extracted from those would give every location of any picture you've ever taken and posted to Instagram, etc.

And that's not even mentioning all of the rights we toss away whenever we click "I agree" to those lengthy TOS agreements that nobody ever reads. Or to say anything of the Patriot Act and the loss of those civil liberties.

People shouldn't get scared by this Verizon leak - that moment passed about 15 years ago.

All of that is true, yet it doesn't mean making such information readily available is appropriate.

There seems to be these sorts of comments every time there's any type of privacy leak and frankly I'm sick of reading it. "Who cares, if you're part of Google's ecosystem, or use Facebook, people know this stuff anyway. You think you're safe? LOL."

It's a hugely dismissive argument. Yes, people can always find stuff about you if they look hard enough or have the sufficient knowledge. There's no such thing as 'real privacy' on the Internet; nobody is denying that. But that doesn't somehow justify even more people or companies making it easier to do so.

Rating: 9 Votes

WRChris

26 months ago

Nothing about this is fake news. Do you know what that even means?

Also your assumption that everyone who uses Verizon customer service uses those other services you talked about seems ludicrous.

Should we not know that our PINs may be in the hands of someone other than the account holder or Verizon?

Rating: 5 Votes

Vasilioskn

26 months ago

Anyone who says “fake news” is usually full of **** these days.

Rating: 4 Votes

McFlyOz

26 months ago

The thing that struck me from this article is that the author said PIN number which is incorrect. It is a personal identification number, as such, already had the word number in the acronym. PIN number offends me as an English speaker.

Rating: 2 Votes

MrX8503

26 months ago

Snapchat geocodes you.

I don't use Snapchat

FB geotags you.

I don't use FaceBook

Your phone tracks everywhere you go.

I believe Apple doesn't track it's users as much as Google, which is why I have an iPhone.

Even this forum has your IP address and could make a discernible guess as to your location.

I have a VPN set up at the router level

Take pictures? The EXIF data extracted from those would give every location of any picture you've ever taken and posted to Instagram, etc.

I don't use Instagram and any photos I post online, I strip the EXIF data.

And that's not even mentioning all of the rights we toss away whenever we click "I agree" to those lengthy TOS agreements that nobody ever reads.

True, which is why I make an effort to deal with companies I trust. I've shed nearly all of my Google apps over the years.

Or to say anything of the Patriot Act and the loss of those civil liberties.People shouldn't get scared by this Verizon leak - that moment passed about 15 years ago.

Basically you've become desensitized and have accepted the lack of privacy as being normal. It's NOT normal, and it's NOT right. Everyone has the right to privacy and the right to demand it.

Rating: 2 Votes

lunarworks

26 months ago

The leak contains account PINs, that number they ask to verify it's you. The other thing is it's millions of users all wrapped up in a tidy, effortless package. No need to spend time trawling for personal info.

Rating: 2 Votes

Bawstun

26 months ago

Rating: 2 Votes

Mick-Mac

26 months ago

"may have had their sensitive data exposed by Nice Systems"
after translating from Marketing to English becomes:
"had their sensitive data exposed by Nice Systems"

Rating: 2 Votes

[ Read All Comments ]