Vodafone denies claim that ‘data of 20 million users leaked’ – Times of India

NEW DELHI: Multiple vulnerabilities in the system of telecom operator Vodafone Idea have exposed the call data records of around 20 million postpaid customers, cyber security research firm CyberX9 said in a report.
Vodafone Idea (Vi), however, said there was no data breach and potential vulnerability in its billing communication was immediately fixed after it learned about it.
According to the CyberX9 report, the vulnerability exposed postpaid customers’ call data records, comprising the time when a call was made, duration of call, location from which the call was made, customer’s full name and address, SMS details comprising contact number to which it was sent, among others.
CyberX9 founder and managing director Himanshu Pathak said that the firm had shared entire findings with Vodafone Idea through email and a company official had acknowledged the vulnerability on August 24.
Pathak said CyberX9 reported details to Vi on August 22.
“Later on August 22, 2022, Vi confirmed the receipt of our report. Vodafone Idea acknowledged the vulnerabilities discovered and reported by us on August 24, 2022,” Pathak said.
When contacted, Vodafone Idea said, “There is no data breach as alleged in the report. The report is false and malicious. Vi has a robust IT security framework to keep our customer data safe.”
“We regularly conduct checks and audits to further strengthen our security framework. We learnt about a potential vulnerability in billing communication. This was immediately fixed and a thorough forensic analysis was conducted to ascertain no data breach,” it said.
The company further said that it has notified about the potential vulnerability to appropriate agencies and made due disclosures, adding, “Vi customer data remains fully safe and secure.”