Vendor call-center staff opened 68,701 customer accounts without authorization (2014) and what it shows about reviewing vendor access

A national wireless carrier ran part of its customer support through call centers, one of them operated by a vendor. From November 2013 to April 2014, three workers at the vendor’s center looked up 68,701 customer accounts. They used logins to the carrier’s customer system. An FCC Enforcement Bureau order and consent decree released April 8, 2015, describes the case. More than 10 years later, outsourced support still works the same way, with outside staff who have real access to a client’s customer records.

This is an insider case. The US Cybersecurity and Infrastructure Security Agency (CISA) defines an insider as anyone who has or had authorized access to an organization’s resources. Its examples include “a contractor, a vendor.”

What happened

The vendor ran a support center for the carrier. Three of its employees used login credentials to open customer accounts and collect names and the last four digits of Social Security numbers. That information could be used to request codes online to unlock phones.

The carrier “maintained and operated the systems” the workers used, and those systems were covered by the carrier’s own security measures. The breach ran for 168 days, from November 4, 2013, to April 21, 2014. From December 2013 until March 2014, more than 11,000 customer accounts were opened each month. The personal information of 51,422 of those customers was used to file 290,803 requests to unlock phones through the carrier’s online portal.

The carrier found the same activity at call centers in two other countries. There, it identified about 211,000 accounts opened to get codes to unlock phones, some of them under managers’ logins. Across all three centers, the FCC put the total at almost 280,000 customers. At least two workers believed to be involved confessed to selling the information to a third party.

The consent decree also records an earlier warning. In December 2012, a carrier employee suspected that a worker at the same center was passing customer information to outsiders. The call center fired that worker for opening customer accounts without leaving account notes.

The cause the record states

The decree quotes the FCC rule at 47 CFR 64.2010(a). It requires carriers to “take reasonable measures to discover and protect against attempts to gain unauthorized access” to customer account data. In the FCC’s words, the carrier’s protections “failed to prevent or timely detect a large and ongoing Data Breach.”

Support staff open customer accounts as routine work. A lookup made for an outsider can look like one made for a customer, so misuse shows up mainly in the pattern. The record describes that pattern in its monthly volume. The record doesn’t say how the workers passed the information on.

Corrective steps

The carrier stopped using the center on September 28, 2014. After May 27, 2014, it masked full Social Security numbers for call-center managers. In December 2014, it changed its policy so that unlocking a phone no longer required information from customer records. That removed the reason to look the records up. The carrier told the FCC it was building new monitoring to flag suspicious account lookups by call-center staff.

Under the consent decree, the carrier paid a $25 million civil penalty and agreed to a compliance plan. The plan includes a risk assessment covering its own and its vendors’ employees. It also requires access controls that limit customer data to authorized staff and processes to detect “suspicious or anomalous account activity.” The carrier must also check vendors’ security by contract and monitor whether they comply.

Controls usually expected after incidents like this

The same controls appear outside telecom. The FTC Safeguards Rule, for covered financial institutions, requires limiting each authorized user to the customer information “they need to perform their duties” (16 CFR 314.4(c)(1)(ii)). It requires monitoring and logging of authorized users’ activity to detect unauthorized access or use (314.4(c)(8)). It also requires choosing capable service providers, binding them by contract and assessing them periodically (314.4(f)).

Narrow access limits what one worker can take. Activity logs tied to a person make a pattern visible. Periodic review means someone actually looks at those logs. What the rules ask of a client that hands work to a vendor is covered in What is vendor oversight?. What follows when a vendor’s breach exposes your data is in What US rules expect of you when a vendor’s breach exposes your data.

Questions to ask about your own setup