Australian telco customers have been warned to be alert for suspicious activity as police investigate reports that personal contact information is being offered for sale after being leaked by call centre staff in India.
Telstra and Vodafone are urging customers to report any fraudulent activity after Fairfax Media reported on Wednesday that personal details of customers are being offered for sale by a Mumbai-based security firm, AI Solutions, which obtained them illegally from call centre operators.
Both telecommunications companies are aware of allegations AI Solutions is on-selling the contact numbers, addresses, and other private details. The details could potentially be used for identity theft, other privacy breaches or fraudulent activities, and by cold callers.
Speaking at Telstra Investor Day on Thursday, Telstra CEO Andy Penn said the telco does not do business with AI Solutions.
“Customer privacy is critically, critically, critically important,” Penn said. “We have no involvement, no engagement with the organisation that has been purported to be selling customer information.
“We have very strong controls around privacy in all of our calls centres, it’s something we take very seriously.
“I am sorry that in the situation you are referring to that customers of other organisations have been affected. It’s something we take very seriously and will continue to do so.”
A Telstra spokesperson told AAP on Thursday that the company had not seen any evidence of AI Solutions having access to its systems.
The Australian Federal Police (AFP) is helping Indian authorities investigate the claims, and AFP cybercrime investigators have met with Vodafone and Optus about “customer information” issues.
“The AFP subsequently provided information to Indian authorities for them to progress,” an AFP spokesperson said.
An Optus spokeswoman did not comment directly on the media reports, but said the company took the protection of customer data and privacy seriously.
Call centre staff are regularly monitored and are not allowed to use recording devices, phones, or pens and paper at their workstations, the spokeswoman said.
The report in Fairfax publications said AI Solutions is asking between AU$350 and AU$1,000 for some private information, and more if the target is a “VIP, politician, police, [or] celebrity”.
Fairfax reported that an AI Solutions representative wrote to a Melbourne corporate intelligence company, which stated that it has a “long list” of Australian clients buying data from offshore call centres.
Australian Telecommunications Industry Ombudsman (TIO) Judi Jones told ABC Radio National on Thursday morning that telcos have an obligation to ensure the data they control is stored securely overseas.
“The information they are storing is covered by Australian Privacy Law, so I know the telcos are very concerned about this,” Jones said.
The ombudsman said the issue has not been raised specifically with the TIO.
Jones said the Office of the Australian Privacy Commissioner would be looking into the issue.
Australian Information and Privacy Commissioner Timothy Pilgrim said in a statement he was concerned about the allegations.
“These allegations, and the community response they have generated, are a reminder that Australian customers expect businesses to handle their personal information in line with Australian law no matter where they operate,” he said.
Pilgrim said anyone with concerns should contact his office.
With AAP
Updated at 2.58pm AEDT, November 17, 2016: Added comment from OAIC.