Chinese phonemaker OnePlus alerts customers to data breach

Word of the OnePlus breach came one day after T-Mobile announced its own security incident.

Chinese smartphone manufacturer OnePlus has confirmed it experienced a data breach involving some users’ names, contact numbers as well as their email and shipping addresses.

In a post Friday on OnePlus’ community forum, a company representative said the security team determined “an unauthorized party” accessed data “within certain orders.” OnePlus did not disclose the number of customers affected, when the incident occurred, nor how the outsiders infiltrated its systems. Payment data, passwords and accounts are unaffected by the breach, the company said.

Word of the OnePlus breach came one day after T-Mobile announced its own security incident. T-Mobile said information associated with customers’ prepaid service accounts was affected, including phone numbers, account numbers, rate plan and rate features. Payment data and password information were unaffected in that breach, too.

Shenzhen-based OnePlus operates in more than two dozen countries, specializing in the production of smartphones and other consumer electronics. The company has an annual revenue of more than $1 billion, and boasts of international growth due to the affordable phones. By undercutting competitors like Apple, the strategy goes, OnePlus is aiming to impress global customers with similarly large glass phones.

The breach disclosed Friday only is the latest security incident at the company. OnePlus said in January 2018 that 40,000 customers who shopped in the online store were vulnerable to attacks from hackers who collected debit and credit card numbers from the checkout.

“We took immediate steps to stop the intruder and reinforce the security, making sure there are no similar vulnerabilities,” OnePlus said Friday. “Before making this public, we informed our impacted users by email. Right now, we are working with the relevant authorities to investigate this incident.”

The post went on to warn that customers may receive an uptick in spam and phishing attempts as a result of this compromise. All affected customers would receive an email by Friday, OnePlus said.

The company plans to launch a bug bounty program by the end of December, it added.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure