Lyca Mobile confirmed customer data theft after cyberattack

Lyca Mobile, a London headquartered mobile virtual network operator that says it has more than 16 million customers, disclosed in early October 2023 that a cyberattack had disrupted its network. The company said it first detected the incident on September 30 and responded by isolating and shutting down compromised systems.

The disruption stopped customers and retailers from buying top-ups and interfered with national and international calling. Lyca said every market it serves was affected except the United States, Australia, Tunisia and Ukraine. Mobile services were restored within days, although some operational functions took longer to recover.

On October 6 the company went further and confirmed that attackers had reached at least some of the personal information held in its systems. Lyca said the records it holds include names, dates of birth, addresses, copies of identity documents such as passports and identity cards, logs of customer service interactions, and some payment card information including the last four digits of card numbers. It did not say how many customers were affected.

Lyca notified the UK Information Commissioner's Office, which told TechCrunch it was assessing the information, and said law enforcement had also been informed. Earlier in the week the company had said it was confident its records were fully encrypted. No group publicly claimed the attack, and Lyca declined to say whether ransomware was involved.