Yahoo Inc, keeping up with its poor security has now compromised more then 80,000 users from Telecom NZ.
Telecom NZ a New Zealand based communications service provider (CSP), providing fixed line telephone services, a mobile network, an internet service provider (through its subsidiary Xtra), and a major ICT provider to NZ businesses (through its Gen-i division). It has operated as a publicly traded company since 1990.
In the biggest cyber attack in New Zealand’s history, the hackers found unknown vulnerability in telecom’s servers resulting in taking over of contact details of more then five percent of user accounts. The service has about 450,000 subscribers at the moment.
Yahoo Inc states that “The hackers got information of contact list but “currently no evidence” if other confidential information was compromised”.
Telecom NZ is now under pressure of canceling the outsourcing deal with Yahoo over such a sophisticated attack, in a statement the telecom’s representative said that “We take security and our customers’ data extremely seriously, We are genuinely sorry for the disruption this issue has caused and we understand that people want answers.
ScMagazine reports that an Institute of IT Professionals chief executive Paul Matthews told NBR it was clear Yahoo’s security had been breached.
“The institute has been notified by a number of members that Yahoo appears to have been the subject of a major cross-site scripting (XSS) attack in recent weeks which now appears to have been mutated to Xtra email over the weekend,” Matthews said.
“A phishing link took them to a site that appeared to be a news story but in the background, exploited the Yahoo vulnerability to gain access to their Yahoo mailbox. “Once it had control of the account it then appears to have sent itself to everyone in the victim’s address book.”
Telecom NZ and Yahoo Inc, both are unsure of what really happened, but experts are positive that the vulnerability was on Yahoo Xtra system.
At the time of publishing this article, the hacked Xtra accounts were canceled, passwords changed and investigation in process.
Stay tune to get more update on this issue.
