News

Hacker selling Vodafone’s Ho Mobile database of 2.5M users

A threat actor has posted a thread on one of the dark web forums claiming to sell Ho Mobile’s database of 2,500,000 users, as observed by Security Report.

Ho Mobile is an Italian telecom carrier owned by Vodafone.

This week threat analyst Bank Security first shared details related to the post on Twitter, after which Security Report analyzed the data sample posted in the forum.

While there is nothing confirming yet if this data is authentic and belongs to Ho Mobile, as observed by Security Report, the leaked data sample of 10 customers posted by threat actor LongPig includes:

  1. Customer’s PII: name, date of birth, address, email, mobile number, etc.
  2. SIM card PUK code
  3. ICCID number
  4. IMSI number
  5. Various base64-encoded hashes
Image: Forum user LongPig posts data sample of 10 customers

This information can be abused by threat actors in SIM swapping attacks to effectively take control of the phone number.

Consequently, attacks may be able to bypass SMS-based 2FA (two-factor authentication) security employed by banking websites, email, and security-centric online systems and potentially breach customer accounts on these websites.

Another forum user responded to LongPig’s post snarkily commenting:

Probably not worth much after KE-LA, IB-Group, and whatever other extra-chromosome baring collective (security firm) sees this

To this, LongPig rebutted with, “all data is already dumped and to sim swap you require only phone number and the ICCID so it will still works unless they send new SIMs card to all 2,5M customers.”

Vodafone or Ho Mobile have not yet confirmed if this data is authentic. Should that be the case indeed, it might be very difficult for the telecom carrier to safeguard customers against SIM swap attacks originating from this leak, as the threat actor says, without reissuing the SIM cards.

Security Report has reached out to Vodafone and Ho Mobile and we are awaiting a response.

Update 29-Dec-2020:

While calling the threat actor’s claims “rumors,” Ho Mobile has told us that they are currently investigating the case:

“With reference to some rumors published by the press, ho.mobile has no evidence of massive access to its IT systems that have jeopardized the data of the customer base.”

“We have started investigations in collaboration with the investigative authorities for further investigations. We remain at your disposal,” a Ho Mobile spokesperson told Security Report.

Update 30-Dec-2020:

However, not everyone is convinced, as a supposed API that would return Ho Mobile users’ information seems to have existed since at least 2019.

Update 4-Jan-2021:

After previously dismissing reports of the data breach as “rumours,” Ho Mobile has now admitted to the data breach in a notice issued today.

https://www.ho-mobile.it/comunicazione/

Thanks to Bank_Security for the initial tip off and for providing updates throughout this developing story.

Ax Sharma

Ax Sharma is a UK-based security researcher, journalist and TV subject matter expert experienced in malware analysis and cybercrime investigations. His areas of interest include open source software security and threat intel analysis. Frequently featured by leading media outlets like the BBC, Channel 5, Fortune, WIRED, The Register, among others, Ax is an active community member of the OWASP Foundation and the British Association of Journalists (BAJ).

Recent Posts

ParkMobile’s $32.8 Million Data Breach Settlement = You get $1?

In 2021, parking app ParkMobile suffered a massive data breach impacting 22 million users whose…

2 days ago

8 Brutal Truths About Cybersecurity I Wish I Knew

When I first got into cybersecurity, I thought it was all about hackers in hoodies…

3 days ago

US Air Force Probes Potential SharePoint-Linked Privacy Breach

The US Air Force is investigating a “privacy-related issue” that may have exposed personally identifiable…

4 days ago

Harrods third-party breach exposes 430,000 customer records, hackers reach out

London’s iconic department store Harrods has disclosed that approximately 430,000 customer records were compromised in…

6 days ago

WestJet confirms customer ID, passports stolen in June cyberattack

WestJet confirmed that in a June 2025 cybersecurity incident, a “sophisticated, criminal third party” gained…

6 days ago

Did You Also Get a ‘Real’ Phishing Email From GitHub.com?

Imagine getting an email straight from GitHub’s own notification system: the same one you've trusted…

1 week ago

This website uses cookies.