All the latest UK technology news, reviews and analysis

Update: O2 accused of passing customers' phone numbers to web sites

by Dan Worth

25 Jan 2012

Be the first to comment

  • Tweet this
O2 logo with bubbles

O2 is facing a backlash from its customers after it was claimed the firm is passing users' mobile phone numbers to any web site they visit when accessing the internet over a data connection.

An online report shows that visiting a site causes the user's number to be displayed, alongside other information on the device accessing that site such as its operating system and model number.

V3 tested the claim on an HTC Mozart device and can confirm the device's phone number was displayed.

Tests with phones on Orange, Vodafone and T-Mobile did not display any numbers, suggesting it is only O2 that provides this information.

V3 contacted O2 for comment on the issue and the firm said it was investigating the reports, but had issued no statement as yet.

Meanwhile the Information Commissioner's Office (ICO) said it was aware of the claims and was planning to contact O2 to discuss the incident.

"When people visit a web site via their mobile phone they would not expect their number to be made available to that web site," it said.

"We will now speak to O2 to remind them of their data breach notification obligations, and to better understand what has happened, before we decide how to proceed."

Security expert Graham Cluley from Sophos pointed out that the discovery of such a measure is not actually new, but said that it was strange O2 would be engaging in such a practice.

"It's hard to understand why a mobile phone network operator would think it is necessary to transmit their customers' mobile phone numbers to the web site they visit," he said in a blog post.

"My guess is that it's more likely to be a cock-up than malice which caused this data to be leaked - but what's worse is that the problem is still present almost two years after it was first discovered."

Update at 14:54: The issue appears to be fixed now, with the device's number no longer showing on the test page. The firm has also issued a blog claiming it has fixed the issue and apologised to customers.

Do you agree?

 

Add your comment

We won't publish your address
By submitting a comment you agree to abide by our Terms & Conditions. Your comment will be moderated before publication.

Poll

Flame virus poll

Are you confident that the UK's IT infrastructure is secure from attack in the wake of the Flame malware revelations?

41%

0%

10%

49%

Connect with V3.co.uk

Sign up to our daily or weekly newsletters

Symanteccloud

Social networking: a guide for IT managers

Social networking is almost ubiquitous. This white paper examines the benefits and risks and it looks at the different ways companies can reconcile them

Riverbed

Mitigating the risks of IT change

The importance of understanding your infrastructure

Pharma IT Quality Manager

On behalf of our client, a major player in the pharmaceutical...

Martini Repo Developer / Lead Developer, Singapore

Qualifications & Skills - Previous development...

Senior Project Manager

Harvey Nash is currently recruiting a senior project...

.Net Developer

URS supplies integrated engineering, environmental and...

To send to more than one email address, simply separate each address with a comma.