Rogers says hackers accessed limited Rogers and Fido customer information
Rogers Communications says it found unauthorized third-party access to limited customer information belonging to Rogers and Fido customers, making it the third major Canadian telecom company to disclose a data incident in the space of a few weeks.
Telecom account data is a favourite target for fraudsters. Names and account numbers can be used to impersonate a customer when calling a carrier, a common first step in SIM-swap fraud that hijacks phone numbers to intercept banking codes.
What happened
Rogers told The Globe and Mail, which first reported the breach, that it identified "unauthorized third-party access to limited customer information" through its own cybersecurity monitoring, MobileSyrup reported on March 30. Spokesperson Zac Carreiro said the company took immediate steps to investigate and add protection.
The information involved includes customers' names, contact information, account numbers and language preferences. Rogers said financial information, social insurance numbers, dates of birth and passwords were not affected, and that it had not identified unauthorized access to any personal financial information.
The disclosure followed a confirmed intrusion at Telus Digital earlier in March and a second breach at Quebecor's Freedom Mobile, which notified customers on March 18 that a subcontractor's credentials had been used to reach its customer account platform in January.
What we don't know yet
Rogers has not said how many customers were affected, how the third party got in, how long the access lasted or who was responsible. The company said it was still reviewing the number of affected customers and planned to notify them.
What to do
- Add or update a port-out PIN or account PIN with your carrier to make SIM swaps harder.
- Be wary of calls, texts or emails claiming to be from Rogers or Fido that ask you to confirm account details, pay a bill through a link or share a one-time code.
- Where possible, use an authenticator app rather than text messages for two-factor authentication on banking and email.
- Report suspicious messages to 7726 (SPAM) and to the Canadian Anti-Fraud Centre.
