W grudniu, po ponad 4 latach codziennego boju, przyszedł czas skierować mojego poczciwego i zasłużonego Nexusa 4 na emeryturę. Jako, że jestem fanem czystego Androida i lubię mieć wybór to nie przepadam za nakładkami producentów. Jeśli już chcę coś zmodyfikować, to wolę raczej skorzystać z Xposed czy Magiska. Wybór zatem padł na OnePlus 5T. Krótko po jego zakupie okazało się, że serwis producenta padła ofiarą wycieku danych, konkretnie numerów kart kredytowych – do czego OnePlus oficjalnie się przyznał.
Wczoraj ruszyła akcja, w ramach której OnePlus daje możliwość monitorowania swojej „aktywności kredytowej” przez rok – na koszt OnePlus. Potwierdzono też techniczne informacje na temat wydarzenia – doszło do wstrzyknięcia złośliwego kodu przez nieznanego atakującego w stronę zajmującą się procesem płatności. Wyciekły informacje nt. płacącego, w tym oczywiście numer karty, data jej ważności i kod CVV/CSC. Ze względu na to, że działał kod nie da się określić czyje konkretnie dane uległy wyciekowi. Niemniej OnePlus ostrzega przed niebezpieczeństwem zaciągania kredytów na dane osób, których dane wyciekły.
OnePlus zrealizował także obowiązek notyfikacyjny względem odpowiednich organów – zgodnie z prawem Hong Kongu. Ciekawe czy w OnePlus wiedzą, że tego typu sytuacje będą musieli także – w ciągu 72 godzin od momentu stwierdzenia naruszenia – po 25 maja tego roku notyfikować Prezesowi Urzędu Ochrony Danych Osobowych ;-). Jestem bardzo ciekaw jak podmioty z siedzibą w tzw. państwach trzecich (poza Europejskim Obszarem Gospodarczym) będą się stosować do przepisów RODO-GDPR. Przepisy bowiem w tej konkretnej sytuacji narzucają określone obowiązki spółce będącej właścicielem OnePlus.
Abstrachując od tego co się stało – trzeba OnePlus pochwalić za postawę pokazującą jak zachowywać się po wycieku. Swoją drogą trzeba też pochwalić bank „T‑mobile usługi bankowe dostarczane przez Alior Bank”, który zablokował moją kartę w euro i bardzo szybko (kilka godzin po tym, gdy ujawniono wyciek) i zadzwonił z propozycją bezpłatnego wyrobienia nowej.
Poniżej wiadomość, którą dostałem od OnePlus:
The OnePlus Team
18F Tairan Building, Block C, Tairan 8th Road
Chegongmiao, Futian District
Shenzhen, Guangdong 518040 ChinaFebruary 12, 2018
Dear Konrad Mazur,
We were recently involved in a security incident potentially affecting personal information relating to you. This notice describes what we know so far, steps we have taken in response to the incident, and actions you may wish to take to protect yourself.
We are working to provide potentially affected customers a year of free credit monitoring, where it’s available. This service means you can quickly and easily check as well as receive alerts about any changes to your credit history. Please register your interest via the following link: https://oneplus.net/claim.
What Happened
On January 11, 2018, we were notified of several credit card fraud cases possibly related to purchases made at OnePlus.net. We promptly took steps to investigate the situation, and ultimately determined that an unknown attacker had injected a malicious script into the payment processing page of our website to intermittently capture credit card information as it was being entered. We immediately quarantined the affected server, reinforced our systems, and disabled credit card payments for good measure.
What Information Was Involved
We believe that personal information relating to you, including your credit/debit card number, credit/debit card expiration date, and CVV/CSC number, may have been compromised during the incident. As noted above, the malicious script appears to have only intermittently captured customer information, so we cannot confirm that your data was compromised. However, out of an abundance of caution, we are providing this notice to all customers that submitted their credit card data on our online store during the window of time in which the malicious script is believed to have been active.
What We Are Doing
Your privacy and data security are extremely important to us. We regularly review and enhance the OnePlus IT and cybersecurity systems and processes. In addition to investigating the incident, we have engaged an expert cybersecurity firm to assist with reinforcing the security of our systems. We also thoroughly reviewed and confirmed the security of the affected webpage before reinstating credit card payments for our website. We have also reported the incident to Hong Kong law enforcement.
We are also taking steps to notify each individual whose personal information was potentially affected by this incident. We will continue to take appropriate steps to minimize the risk of future cybersecurity incidents.
What You Can Do
As a general rule, we recommend that you remain vigilant about your personal information by regularly reviewing your financial account statements and periodically checking your credit report. Review the reports carefully for inquiries from companies you did not contact, accounts you did not open, and debts that you cannot explain. Verify the accuracy of your complete name, identification number, address(es), and employer(s).
You may wish to add a fraud alert to your credit report file to make it more difficult for someone to get credit in your name. A fraud alert is a consumer statement added to your credit report. This statement alerts creditors of possible fraudulent activity within your report as well as requests that they contact you prior to establishing any accounts in your name. Once the fraud alert is added to your credit report, all creditors should contact you prior to establishing any account in your name.
You may also add a security freeze to your credit report file to prohibit a credit reporting agency from releasing information from your credit report without your prior written authorization. To place a security freeze (also known as a “credit freeze”), contact the three credit reporting agencies at the contact information provided above. Unlike a fraud alert, you must separately place a credit freeze on your credit file at each credit reporting agency. Please be aware that using a security freeze may interfere with or delay your ability to obtain credit. You may also incur fees to place, lift, and/or remove a security freeze.
Be vigilant against phishing attacks. Some criminals may use your personal information to contact you posing as a reputable source to try and trick you into providing confidential information (commonly called “phishing”). For example, they might call you or email you pretending to be a trusted party and ask you to confirm sensitive personal information, such as your social security number or financial account information. Please know that we will never ask you to confirm any sensitive personal information by email or over an unsolicited phone call. If you do happen to be contacted with such a request, it is not from OnePlus, and you should not provide any personal information.
We truly regret any inconvenience this incident causes you. If you have any questions, please contact us using the contact information provided below.
Sincerely,
The OnePlus Team