Yesterday, it was reported that Google Fi may have been affected by the recent data breach that T-Mobile encountered. Although the information revealed at the time was that a “limited amount of Google Fi customer data” was exposed in the hack, it turns out that (at least) one customer had a more serious encounter.
The Google Fi customer shared his experience on Reddit (via 9to5Google) that his phone number was moved to another device. The customer received a different email from Google compared to the rest of the affected users whose personal data were not compromised. This one customer, however, received an email that read:
Additionally, on January 1, 2023 for about 1 hour 48 minutes, your mobile phone service was transferred from your SIM card to another SIM card. During the time of this temporary transfer, the unauthorized access could have involved the use of your phone number to send and receive phone calls and text messages. Despite the SIM transfer, your voicemail could not have been accessed. We have restored Google Fi service to your SIM card.
Google also informed the customer that his phone service was transferred to another SIM card for less than two hours.
The customer spoke with 9to5Google and shared the unusual activity he experienced last January 1st. He received unauthorized access and password reset notifications from his online accounts via email, such as Authy, a crypto wallet, and Outlook email address; which were all accessed by a third-party. His passwords were successfully reset on his Outlook and crypto account.
Since the customer’s phone number was moved to the SIM card of the attacker, he wasn’t aware of anything happening. He only found out about them on his email, which included a number of SMS messages exchanged within a 45-minute window. Thankfully, the customer was able to regain access to the compromised accounts. He also managed to get his phone number back by resetting network access on his iPhone.
9to5Google was able to get the email verified by a former Google security researcher. Meanwhile, the customer was offered two years of credit monitoring and identity theft protection by Google.
As of this writing, there hasn’t been any other Google Fi customer who came forward with the same experience. This makes us wonder if it could have been a targeted attack. Hopefully, the customer doesn’t lose anything valuable in the attack.
Source: 9to5Google
