Dan Goodin, a senior editor at Ars Technica recently reported that Q Link Wireless (Q Link), which buys services in bulk from other wireless carriers and resells them, and provides government-subsidized telephones and services through the FCC’s Lifeline Program to 2 million customers, has provided “sensitive account data available to anyone who knows a valid phone number on the carrier’s network.”
According to Goodin’s post, the carrier offers the My Mobile Account App that customers can use for different purposes. When accessing the app, it displays one’s:
- First and last name
- Home address
- Phone call history (from/to)
- Text message history (from/to)
- Phone carrier account number needed for porting
- Email address
- Last four digits of the associated payment card
Goodin confirmed that since at least December 2020, anyone who downloaded the app and has a valid telephone number of a customer could access these data without a password. “That’s right—no password or anything else required.”
Goodin contacted Q Link about the security snafu (after others had done so previously) with a dozen messages, but got no response. But days later, he found that his account stopped connecting to other customers’ accounts when provided a valid telephone number.
Acknowledging that there was no indication that “the leakage was actively exploited,” Goodin also observed that “the carrier has yet to notify customers of the data exposure.” He recommends that “[p]eople using the service should consider any data displayed by the app to be available to anyone who has their phone number.”