Charter Communications, the telecommunications giant behind the Spectrum brand, is facing growing scrutiny after confirming a cybersecurity incident that hackers claim resulted in the theft of millions of customer records.
The breach was exposed not by the snap IT folks at Charter seeing odd behavior in the network, but after the cybercriminal group known as ShinyHunters listed the company on its data leak site and threatened to release allegedly stolen information. That information, the attackers claim, included sensitive information they deemed worthy of a proud ransom payment.
According to reports, the attackers gained access through a voice phishing, or “vishing,” attack that targeted an employee. By convincing the employee to allow them into a Microsoft Entra (fomerly Azure Active Directory) account, the attackers reportedly were able to get deeper access into Charter’s cloud-based systems and retrieve customer data.
Vishing, as you may recall, is phishing done using voices, rather than email or text messaging.
The hackers claim they obtained tens of millions of records containing names, email addresses, phone numbers, physical addresses, service plan information, and customer support records. But wait! Charter disagrees. The company has acknowledged the incident did indeed occur, but insists that highly sensitive personal information and customer proprietary network information were not exposed.
Regardless of the exact number of affected records or even what information was stolen, cybersecurity experts warn that even basic contact information can be valuable to criminals. Data stolen in breaches is often used to craft convincing phishing emails, fraudulent text messages, fake technical support calls, and other scams designed to trick victims into revealing additional information. This is all what customers of Spectrum and Charter should be on the lookout for now and well into the future. If a message creates urgency or asks for personal information, verify it through official channels before responding.
This is yet another reminder that cybercriminals are increasingly targeting people rather than technology. After all, by convincing a user to give up their credentials freely, they can avoid all kinds of technological security checks. A well-crafted phone call can sometimes accomplish what sophisticated malware cannot.
SUBSCRIBE TO WEEKLY NEWSLETTER
