Edited by Fabrizio Vedana

Ho.Mobile, Vodafone's low-cost mobile operator, has informed many of its Italian customers that it was the victim of a hacker attack that resulted in the theft of millions of users' data.

The text message reads: "We are writing to inform you that unfortunately, ho.Mobile, like many other companies, has been the victim of cybercrime, which has intensified during the pandemic. In-depth analyses, currently underway and in close collaboration with the investigating authorities, have revealed that part of your data was illegally stolen, specifically your personal details and the technical data of your SIM card. No traffic data (calls, SMS, web activity, etc.) or banking or payment information was stolen. We have immediately activated additional and new levels of security to protect all customers from the threat of potential fraud. You can, however, request a free SIM replacement at any authorized ho.Mobile point of sale.

Can users, now approximately 2 million in Italy, consider themselves safe from further thefts?

ho.Mobile announced that it has remotely changed (without requiring customers to visit a store) the ICCID (Integrated Circuit Card Identity), the unique serial number that identifies the SIM card on the internet. However, the ICCID change only occurred for the users involved in the hacker attack, not for all ho.Mobile customers.

Vodafone thus effectively neutralized the stolen data that could have caused the most damage. Through ICCID, customers could have been victims of SIM swapping, a rapidly growing hacking practice in Italy. Hackers or whoever obtained the stolen data could, by showing the Integrated Circuit Card-Identity, obtain a SIM card registered in the victim's name and, through this, gain control over that phone number (in essence, identity theft).

The theft of customer data, however, remains: the criminals stole names, surnames, dates of birth, home addresses, email addresses, ICCIDs, and other data, and likely sold the data to other parties for a relatively large sum. This has clearly damaged the privacy of the telephone company's tens of thousands of users.

This incident demonstrates once again the importance for companies to adopt all necessary and adequate data security measures, including IT security, as both the European Commission and national parliaments have long been calling for.