Three UK customer details exposed in homepage blunder

World+dog could view security answers and more

The Three homepage that Reg reader Chris saw – but that’s not his name or phone number

Exclusive Mobile operator Three UK’s website was showing visitors other customers’ names, postal addresses, phone numbers, email addresses and more – all without asking for a login.

Alarmed Reg reader Chris immediately tweeted at Three to ask what on Earth was going on, querying why Three’s site was displaying different people’s data to him every time he changed page.

Click to enlarge

The site was showing him as logged in even though he’d only gone to the mobile operator’s homepage.

“When you load their site over your mobile internet connection, it recognises you and automatically logs you in,” Chris told us. “I was doing this on my home Wi-Fi (which isn’t Three), so it should’ve required me to log in manually when I first went to their site. I guessed it might’ve either redirected me to a session for a valid user who was accessing at the same time, or some blip which didn’t recognise me and just assigned another user’s ID instead.”

Click to enlarge

“I wasn’t able to to view any payment details – card or direct debit, and I wasn’t able to load any detailed bills to view itemised activity,” added Chris. Three claims to have around 10 million registered subscribers.

Click to enlarge

While our reader waited for a response from Three (it replied to him on Twitter an hour and a half after his initial tweet), he tipped off El Reg. As we investigated, we noticed the company website went down for a little while with the standard “under maintenance” page displayed – and came back up again after about an hour. Chris said other people’s data was no longer visible once the site returned.

The nature of the data breach suggests that potentially the entire customer database along with some of the personal data held on file may have been exposed.

Despite repeated contact with Three’s PR representatives, none of The Register‘s questions about the potential size or scale of the breach have been answered.

Judging by the URLs visible in some of the other screenshots Chris sent us, which included the letters /new, the company’s techies may have accidentally deployed an under-construction revamp of the site to the mobe firm’s production servers. This is merely speculation and Three has not responded to questions on this.

The Information Commissioner’s Office was unable to say, at the time of publication, if Three had reported the breach. ®

Updated to add at 1628 UTC:

An ICO spokesperson told us: “Three has made us aware of an incident and we will be making enquiries.”

A Three UK spokesperson told us: “A small number of customer[s] have reported an issue to us regarding my3. We have blocked access to my3 while we investigate the issue.”