Google Fi warns you that your data has been compromised

TechCrunch reports that Google has noti­fied cus­tomers of its MVNO (Mobile Vir­tu­al Net­work Oper­a­tor) ser­vice, Fi, that a hack­er was able to access some of their information.

Accord­ing to the tech giant, the cul­prit com­pro­mised a third-par­ty sys­tem used for cus­tomer sup­port for major Fi net­work providers. Google does­n’t direct­ly name providers, but Fi relies on US Cel­lu­lar and T‑Mobile for connectivity.

The lat­ter admit­ted in mid-Jan­u­ary that hack­ers had been steal­ing data from the com­pa­ny’s sys­tems since Novem­ber last year.

Accord­ing to T‑Mobile, the attack­ers had access to the infor­ma­tion of approx­i­mate­ly 37 mil­lion post­paid and pre­paid cus­tomers by the time they dis­cov­ered and fixed the issue.

At the time, the com­pa­ny claimed that no pass­words, pay­ment data or social secu­ri­ty num­bers were stolen. The same goes for Google Fi, adding that no PINs or text messages/calls were stolen.

It appears that the hack­ers only had access to some ser­vice plan data, such as user phone num­bers, account sta­tus, SMS card ser­i­al num­bers, and inter­na­tion­al roaming.

Google has told most users that noth­ing needs to be done and is still work­ing with Fi net­work providers to “iden­ti­fy and imple­ment mea­sures to pro­tect data on their sys­tems.” We have noti­fied all poten­tial­ly affect­ed parties.”

How­ev­er, at least one cus­tomer is claimed to have had more seri­ous prob­lems than oth­ers due to the infor­ma­tion breach. This cus­tomer is part of an email alleged­ly sent to him by Google on Jan­u­ary 1, over a peri­od of about two hours, inform­ing him that “cel­lu­lar ser­vice has been trans­ferred from (his) SIM card to anoth­er SIM card.” Part has been pub­lished on Reddit.

The cus­tomer said he received a pass­word reset noti­fi­ca­tion for his Out­look, cryp­tocur­ren­cy wal­let account, and Authy two-fac­tor authen­ti­ca­tion that day. They sent logs to 9to5Google to prove the attack­ers were using their num­ber to receive text mes­sages to access these accounts.

Fi’s text mes­sage his­to­ry revealed that the per­pe­tra­tors began request­ing pass­word resets and two-fac­tor authen­ti­ca­tion codes via SMS with­in a minute of the SIM card being transferred.

This cus­tomer seems to have been able to inter­act with their account after turn­ing net­work access on their iPhone off and back on, but I’m not sure if that fixed the issue. We’ve reached out to Google regard­ing SIM swap cus­tomer com­plaints and will update this arti­cle as soon as we hear back.