Hackers might have been able to access “a massive amount of sensitive information” involving communications companies — including “more than 4 million records” from customers of Charter’s Time Warner Communications — Kromtech Security Center reports today.
The firm says in a blog post that in July it discovered an unprotected cloud-based data repository connected to a World Wrestling Entertainment domain. In tests, Kromtech found it was able to access two repositories in the cloud system offered by Amazon, and using software from BroadSoft.
Time Warner Cable data appears to have been especially vulnerable.
Kromtech found “more than 4 million records” spanning November 26, 2010, to July 7, 2017, “with Transaction ID, user names, Mac addresses, Serial Numbers, Account Numbers, Service, Category details, and more,” it says.
“Other databases also have billing addresses, phone numbers, etc. for hundreds of thousands of TWC customers,” it adds.
Kromtech Security Center Chief Communications Officer Bob Diachenko says that engineers “accidentally leaked not only customer and partner data but also internal credentials that criminals could have easily used to monitor or access company’s network and infrastructure.”
Charter, which bought Time Warner Cable last year, says that an unidentified vendor told it that “certain non-financial information of legacy Time Warner Cable customers who used the MyTWC app became potentially visible by external sources.”
The information “was removed immediately by the vendor, and we are currently investigating this incident with them. There is no indication that any Charter systems were impacted. As a general security measure, we encourage customers who used the MyTWC app to change their user names and passwords.”
It adds that customer privacy “is of the utmost importance to us. We apologize for the frustration and anxiety this causes, and will communicate directly to customers if their information was involved in this incident.”