Subject: [NEXTEL-1] Personal Data Is Pirated From Russian Phone Files

From: Marcel <[email-masked]>
Date: Thu, 23 Jan 2003 19:04:42 -0500

Personal Data Pirated from Russian Mobile Phone Firm

Personal information on what could be thousands to millions of customers was
stolen from Russian mobile phone firm, Mobile Telesystems (MTS). The
information has been put on CDs and is available for sale on the streets of
Moscow. MTS is investigating the information leak, which may not have occurred
inside the company. MTS, like other mobile phone companies and Internet
service providers, is required to give customer information to police and other
government agencies. There is speculation that the leak could have come from a
government source. Mobile phone company Vimpelcom had a similar information
leak in 1998.

==================================================

Personal Data Is Pirated From Russian Phone Files
By SABRINA TAVERNISE

OSCOW, Jan. 22 — It is a prime nightmare of the digital age: all of your personal
information — credit card numbers, home address, Social Security number — stolen and
passed around, or perhaps even posted on the Internet for anyone to see.

Hundreds of thousands, perhaps millions, of customers of Mobile Telesystems, a Russian
mobile phone company, have been discovering firsthand how that feels. The company
acknowledged on Tuesday that it had suffered a huge security breach that led to pirated
CD's, purportedly containing its entire database of five million customers, appearing on
the streets of Moscow.

"We discovered it a few weeks ago," said Yeva Prokofiyeva, a spokeswoman for the company,
which is known as MTS. "It's hard to determine where the leak came from. The measures to
protect the database are very strict."

The breach may not have occurred at the company. Mobile phone operators and Internet
services are required by law to hand over information about their customers to the police
and to government agencies like the Federal Security Service, the successor to the K.G.B.
There is widespread speculation that a low-paid employee at an agency — presumably someone
without an MTS phone — may have sold the data.

"All operators have to give the power structures information," Ms. Prokofiyeva said. "The
leak could have come from inside the company or outside. But it's very difficult to
imagine that it came from inside."

A spokesman for the Federal Security Service said the agency knew nothing of the matter. A
police spokeswoman declined to comment.

The incident was a reminder of one risk of doing business in Russia, where data piracy is
rampant and just about any information can be bought, often quite cheaply. Another large
mobile phone operator, Vimpelcom, had a similar problem in 1998; then, too, state security
services were suspected, though nothing was proved.

In a national survey last fall, large numbers of Russians complained that personal
information about them had been trafficked illegally. Often it turns up in the hands of
hawkers at the Mitinsky market in Moscow, where a vast array of recorded music, movies,
computer software and other goods of dubious provenance can be bought for pennies.

It was not clear today how much information about MTS customers had gotten loose. Ms.
Prokofiyeva could not say whether the pirated CD's actually held the company's whole
roster, or whether credit card data was included. MTS has begun offering new personal
identification numbers, to customers to head off abuse of their mobile phone numbers. As
for the other data and how it came to be leaked, Ms. Prokofiyeva said, "so far, we're
investigating."

http://www.nytimes.com/2003/01/23/business/worldbusiness/23DATA.html

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/