Virgin Media Community

[Franko76]

I got the same Email today and I have not been VM customer for nearly Two years.

(I also keep getting Texts from VM telling me i am approaching my data limit then they give me a fictional 2gb.)

[Chris_W1]

Hi Franko76,

We are sorry to hear that you have been receiving such emails, can you report it here 
Chris 

[Blueyonderer]

This is genuine, unfortunately. It's been all over the IT news for around a week.

https://www.theregister.co.uk/2020/03/06/virgin_more_leak_details/

I was only informed by email today: two of my colleagues were informed last week.

The galling thing is that they've screwed up badly, yet all of the action in the email is directed at us, the victims of their incompetence.

Also, once the ICO gets their act together and issues a fine we'll likley end up paying for it again through higher bills.

This may well be the final nail in the coffin for VM, for me.

Disgusted.

[Blueyonderer]

Read this to find out exactly what was disclosed:

https://www.theregister.co.uk/2020/03/06/virgin_more_leak_details/

The leak was reported to VM by a third party: VM had no idea that the data was visible for anyone looking.

[Graham_A]

"The leak was reported to VM by a third party: VM had no idea that the data was visible for anyone looking."

Also worth pointing out that no evidence has been produced to show that the data was accessed by any party other than the group that reported the vulnerability to VM.

[frankblack98]

@Graham_A: Virgin don't know who has or has not accessed the data, because if their security was up to scratch they wouldn't have left this database accessible and unsecured for more than a year.

Its a crystal clear example of not following the GDPR law.

[punkrock101]

exactly god knows how many people accessed it snooping around in the past year.

[Anonymous]

Virginmedia said that "at least one person has access this database"

Is quite evasive sentence if you ask me. It's the "at least" bit. It's not "we know one person had access it. It's at least. 

Tells me they got no idea. 

[Blueyonderer]

"Also worth pointing out that no evidence has been produced to show that the data was accessed by any party other than the group that reported the vulnerability to VM."

I really wish I was able to share your optimism on this.

The fact VM can only state that 'at least one' person accessed the database probably means that they've got no easy way of finding out... normally a quick look at access logs would tell you immediately. So my conclusion is that either: there are no access logs for the misconfigured cloud container/database, or VM are understating the scale of the problem. Neither scenario is good.

[invyism]

Why is your CEO's team sending out letters with the bog standard "move along, nothing to see here" response that VM is hiding behind over this issue?  We've already had that from your online people, is the CEO under his desk hoping it'll all go away?  Shoddy from the top down.  I sincerely hope the ICO takes a very dim view of VM's response to your mess of your own making.