In a concerning development for Australian internet users, Vocus Group has confirmed a security breach affecting more than 1,600 Dodo and iPrimus customers. The incident, which involved unauthorised access to customer email accounts and mobile services, is the latest in a series of cyberattacks targeting Australia’s major telecommunications companies.
This article breaks down what happened, who was affected, and what steps you can take to protect your personal information. We understand that news like this can be stressful, which is why we’ve compiled all the essential details to help you stay informed and secure.
Vocus, the parent company of Dodo and iPrimus, announced it first detected "suspicious activity" within its email systems on a Friday. To contain the threat, the company took immediate action by temporarily suspending email services for Dodo and iPrimus customers and restricting them for Commander customers. (itnews)
According to a statement from a Vocus spokesperson, an initial investigation revealed that approximately 1,600 email accounts had been compromised. This led to a more serious issue for a smaller group of customers: unauthorised SIM swaps were performed on 34 Dodo Mobile accounts.
A SIM swap, or SIM jacking, is a type of account takeover fraud. Scammers gain control of a victim's phone number by convincing the mobile provider to transfer it to a SIM card in their possession. Once they control the number, they can intercept calls and text messages, including two-factor authentication codes, giving them access to sensitive accounts like banking and email.
Vocus confirmed it worked with the 34 impacted mobile customers to reverse the unauthorised SIM swaps and continues to monitor the situation closely. By Sunday morning, Dodo announced that email access had been restored for all affected users. However, as a precaution, customers were required to contact the telco to set a new password for their accounts.
This recent incident highlights a concerning trend of security vulnerabilities across Australia's telecommunications sector. If you are a customer of Dodo, iPrimus, or even other providers, it is a crucial time to review your account security.
If you are a Dodo or iPrimus customer and have not already done so, it is vital to secure your account immediately.
The Dodo and iPrimus hack forms part of a series of cyber incidents that have raised concerns about data security across Australia’s telecommunications sector.
These incidents underscore the importance of strong cybersecurity practices and open communication within Australia’s telecommunications sector. Vocus Group, the parent company of Dodo and iPrimus, has previously come under regulatory scrutiny. In 2020, the Australian Competition and Consumer Commission (ACCC) commenced Federal Court proceedings against Dodo and iPrimus for allegedly misleading customers about their NBN broadband speeds during busy evening hours. In June 2021, the Court ordered Dodo to pay $1.5 million and iPrimus $1 million in penalties, totalling $2.5 million.
At the time, the ACCC noted that Vocus was Australia’s fourth-largest broadband provider, with approximately 5.2% of the National Broadband Network (NBN) market (ACCC, 2021).
The Dodo and iPrimus hack acts as another reminder that we must all be vigilant about our digital security. While telcos have a responsibility to protect our data, there are proactive steps we can take to safeguard our personal information. Regularly updating passwords, enabling MFA, and staying informed are simple yet effective measures.