The mobile network operator, O2 is facing a backlash from its customers with concerns over privacy issues as it has come to light the company is apparently sharing customers’ mobile numbers with websites they visit on their phones. This data breach was noticed by system administrator Lewis Peckover, who then posted details online of how he noticed mobile phone numbers when visitors came to his website (http://lew.io/headers.php) via their handsets.
Lee said, “O2 seems to be transparently proxying HTTP traffic and inserting this header. If you're on O2's UK mobile network (not ADSL), you'll (probably) see a line beginning with x-up-calling-line-id - followed by your mobile phone number in plain text.
He added, “It is logical to conclude that this same information is sent to all other websites too.” O2 are said to be looking into these claims.
Users who have since discovered this data breach have taken to Twitter to complain about the company. Alexander Hanff, managing director of Think Privacy said via his Twitter account, “RIPA now carries penalties for 'accidental breach' and O2 needs to be held to account for this, numbers effected could be high. The longer this proxy is left running the more significant the breach becomes and hundreds of thousands of customers risk exposure."
Hanff went on to say that malicious websites could be misusing this information by using manipulating tools such as Gmail's two-factor authentification that uses phone numbers for verification.
-----------------------------
UPDATE (17:00PM)
O2 have confirmed they have fixed the issue that shares mobile phone numbers with websites when browsing from a mobile phone. The company also admitted that this privacy breach has lasted two weeks following routine maintenance that was carried out the January 10th.