Verizon-owned Seen, a finances mobile provider owned by Verizon, has confirmed that hackers accessed and charged consumer accounts.
The incident, first reported by The Verge, got here to mild earlier this week after Seen clients took to social media to report that their account had been hijacked. Some reported that their e-mail deal with and password had been modified, and lots of mentioned that undesirable expenses had been made via their Seen accounts.
One buyer wrote within the Seen subreddit that their account was hacked and an iPhone purchased with that consumer’s related PayPal account. One other mentioned that they had three iPhones ordered inside 24 hours of their title. “Every time a distinct transport/billing deal with,” they mentioned.
Whereas Seen initially remained silent on the difficulty, the corporate on Wednesday confirmed on Twitter that “risk actors have been capable of entry username/passwords from exterior sources, and exploit that info to log in to Seen accounts.” This, together with a follow-up tweet advising customers to not re-use passwords throughout a number of accounts, suggests these affected have been possible victims of a large-scale credential stuffing assault, whereby stolen account credentials, sometimes consisting of lists of usernames and/or e-mail addresses and corresponding passwords, are used to realize unauthorized entry to accounts utilizing automated login requests.
Nevertheless, though this means that Seen itself wasn’t breached, many shoppers have highlighted the provider’s lack of two-factor authentication (2FA) help, which can have prevented the hijacking of accounts.
TechCrunch has requested Seen whether or not it has plans to allow 2FA, however the firm has but to reply. The provider has not but mentioned what number of customers are affected.
In a press release given to The Verge, the corporate mentioned: “Seen is conscious of a problem wherein some member accounts have been accessed and/or charged with out their authorization. As quickly as we have been made conscious of the difficulty, we instantly initiated a evaluate and began deploying instruments to mitigate the difficulty and allow further controls to additional shield our clients.
“Defending buyer info — together with securing buyer accounts — is critically essential to our firm and our clients. As a reminder, our firm won’t ever name and ask on your password, secret questions or account PINs. In the event you really feel your account has been compromised, please attain out to us through chat at seen.com.”
Per the Seen subreddit, the corporate has additionally informed clients that, shifting ahead, “any purchases would require you to re-validate your cost info as an added safety measure.” The corporate can be advising customers to reset their passwords, notably if it’s one which’s used for a number of companies.