Three UK's mobile customers experience new data breach

The mobile phone company Three has experienced a fresh data breach after some customers logging into their accounts were presented with the names, addresses, phone numbers and call histories of strangers.

Three said it was investigating a technical issue with its systems and urged those affected to contact its customer service department.

One customer, Andy Fidler, told the Guardian he was presented with the data usage and full call and text history of another named customer when he logged in on Sunday night. Another, Mark Thompson, said on Facebook he received a call from a complete stranger who said she had logged on to her account and was shown his details.

Thompson said it was a “shocking breach of data privacy”. He wrote on Three UK’s Facebook page: “Care to explain just how my details have been shared, how many people have had access to my personal information, for how long, and how many of your other customers have had their details leaked by yourselves to other members of the public as well?”

Other customers also wanted to know why they were being presented with other people’s information when they logged in.

Three UK, which is owned by the telecoms giant Hutchinson and has 9 million customers in Britain, said it was investigating.

“We are aware of a small number of customers who may have been able to view the mobile account details of other Three users using My3,” a spokesman said. “No financial details were viewable during this time and we are investigating the matter.”

The Information Commissioner’s Office said it “will be looking into this potential incident involving Three”.

A spokeswoman for the regulator said: “Data protection law requires organisations to keep any personal information they hold secure. It’s our job to act on behalf of consumers to see whether that’s happened and take appropriate action if it has not.”

The problem comes four months after three men were arrested after fraudsters accessed personal data of thousands of Three customers, including names and addresses, by using authorised logins to its database of customers eligible for an upgraded handset. Customer information from more than 133,000 users was compromised in the incident.

Fidler said he was alerted to the problem at the weekend when he could not access the Three app on his phone, and so logged on through the company’s website. When the account details came up, they were not his.

“I managed to successfully download a complete stranger’s phone bill,” he said. “All I did was click on the link to bring up my bill. It included the name, address, how much they were paying, the phone numbers they had rung and texted.” He said bank details were not available.

Fidler said the problem was incredibly worrying and he had called Three immediately to alert the company.

The call handler originally told him to delete the bill, but then called back with more detailed instructions including not to “touch my account for a couple of days until they have looked into it”.

Fidler said he was concerned he might have been paying someone else’s bill. “Who on earth has got my bill?” he said.