BSNL Data Systems faces data breach

According to a recent data breach investigation, Bharat Sanchar Nigam Limited (BSNL’s), data systems was breached by a well-known threat actor identified as "kiberphant0m." The compromised data allegedly includes critical information such as International Mobile Subscriber Identity (IMSI) numbers, SIM card details, pin codes, and authentication keys. Additionally, the breach allegedly involves data from DP Cards and DP Security Key, along with snapshots of BSNL’s SOLARIS servers.

Kanishk Gaur, CEO of the digital risk management company Athenian Tech said, “It appears that the breach may have been ongoing for a significant period of time before it was publicly disclosed. The nature and volume of the compromised data suggest that ‘kiberphant0m’ had prolonged access to BSNL’s systems. The exact number of affected users is still being assessed, but given the scope of the data compromised, it potentially impacts millions of BSNL subscribers.”

After an inquiry about the authenticity and uniqueness of the data compared to an earlier reported data breach of BSNL in December 2023, Athenian Tech reportedly found that the data being sold is distinct and unrelated to previously sold datasets, which focused on user information. The current data is more complex and critical, relating directly to telecom operations.

“The threat actor priced the compromised data at $5,000, offered as a special deal valid from 5/30/2024 to 5/31/2024. This pricing highlights the high value of the data due to its sensitivity and extensive scope. During conversations on a dark web platform, the threat actor discussed the potential misuse of this data for activities such as SIM cloning and extortion, illustrating the serious risks associated with its criminal exploitation,” the report said.

SIM cloning involves creating a duplicate SIM card with the same IMSI and authentication keys as the original. Once cloned, a SIM card can be used to intercept messages and calls, bypass two-factor authentication, access bank accounts, and commit fraud under another person’s identity. This not only compromises personal security but can also lead to significant financial losses for the victims.