Security flaw meant Virgin Media O2 customers could be tracked for 2 years

The locations of tens of millions of Virgin Media O2 mobile customers in the UK were exposed for up to two years due to a network security flaw, which has since been reported to the Information Commissioner's Office (ICO) and Ofcom. The security vulnerability allowed anyone with a Virgin Media O2 SIM card to track the precise location of any Virgin Media O2 phone customer capable of making 4G calls down to the nearest mobile mast. The tracking was most accurate in urban areas, where mast coverage can be as small as 100 square meters.

Dan Williams, an IT specialist who identified the flaw, stated he first notified Virgin Media O2 in March but received no response until he published his findings on a blog in May. The vulnerability stemmed from Virgin Media O2's incorrect configuration of its 4G calling software, which exposed normally private information such as the location area code and cell ID of callers to end-users. These details, when combined with publicly available tools, could reveal a person's last known mobile mast signal.

The flaw also impacted some customers of Giffgaff and Tesco Mobile.

£ - This Financial Times article requires a subscription.