Cyber Incident Victim: A1 Telekom
Date:
Jan 2023
Location:
Austria
Summary
A cyberattack targeting an external Austrian sales partner of Magenta Telekom compromised up to 20,000 customer records, which subsequently appeared on the darknet. The breach involved personal data but excluded login credentials, with a Russian hacker group claiming responsibility for the incident. Following customer notifications about the breach, reports emerged of attempted fraud leveraging the stolen information.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
The incident involving Magenta Telekom stemmed from a cyberattack targeting an external Austrian sales partner affiliated with the telecommunications provider. Between 2020 and 2022, attackers compromised systems belonging to this third-party vendor, exfiltrating customer data that subsequently appeared for sale on darknet platforms. Magenta Telekom confirmed the breach impacted up to 20,000 customer records, though the company emphasized that login credentials and authentication data remained unaffected by the compromise. Analysis indicated the attackers specifically accessed information stored on servers operated by the external partner rather than Magenta's core infrastructure. A Russian cybercrime group publicly claimed responsibility for the intrusion, though the article did not specify technical details regarding their intrusion methods or the exact data transfer mechanisms used.
Magenta Telekom initiated response protocols upon confirming the breach, including direct notifications to affected customers advising vigilance against potential fraud attempts. The company's public statements clarified the compromised data's temporal scope while underscoring the separation between partner systems and Magenta's primary network security controls. Subsequent reports indicated that some customers received phishing communications or encountered fraudulent activities following the data exposure, though the article did not quantify these secondary incidents. No evidence suggested operational disruptions to Magenta's services resulting from the attack. The telecommunications provider maintained its focus on coordinating with the breached partner and law enforcement throughout the disclosure period without detailing specific forensic findings or remediation steps applied to the vendor's systems.