Verizon retail shop showing data breach of employee data

Verizon Insider Data Breach Impacted Employee Data of More Than 60,000 Employees

A Verizon insider data breach has impacted employee data of 63,206 employees, the company has disclosed in a regulatory filing.

Verizon provides telecommunications, internet, and cable TV services to over 150 million subscribers and employs over 17,000 workers, with an annual revenue of $136.8 billion in 2022.

In 2023, the company was named the most valuable telecom brand globally for the fourth consecutive year.

Verizon does not anticipate serious impacts but has taken additional measures as a precaution.

Verizon employee data breach by a non-malicious insider threat

In a data breach notice filed with the Office of the Maine Attorney General, the telecom behemoth said the “Inadvertent disclosure, Insider wrongdoing” incident occurred when a Verizon employee violated company policy by gaining unauthorized access to a file containing workers’ personal information.

“Around September 21, 2023, a Verizon employee obtained a file containing certain employee personal information without authorization and in violation of company policy,” the company said.

Verizon discovered the data breach on December 12, 2023, and conducted an internal review to determine the nature of employee data exposed.

The probe determined that the exposed employee data includes names, addresses, Social Security numbers or any other national identifier, gender, union affiliations, dates of birth, and compensation information. The Verizon data breach impacted both current and former employees.

The exposed employee data is a valuable resource for fraud and targeted phishing attacks when associated with personal email addresses from previous breaches.

So far, Verizon believes the exposed employee data is safe and has not leaked outside the company.

“At this time, we have no evidence that this information has been misused or shared outside of Verizon as a result of this issue,” noted Verizon.

Employee data can facilitate cyber attacks

While the employee data breach did not affect Verizon customers, cybercriminals frequently target telecom workers to gain access to internal systems and access client data.

To prevent a similar incident from recurring, the telecom giant is enhancing its security controls and has reported the employee data breach to relevant authorities to comply with regulations.

“We are working to ensure our technical controls are enhanced to help prevent this type of situation from reoccurring and are notifying applicable regulators about the matter,” the company said.

This is the second cyber incident, barely a year after the company thwarted an attempted customer account takeover via SIM-swapping fraud in October 2022. Verizon mitigated the impact of successful SIM swaps by restoring all phone numbers ported to other networks. However, that data breach exposed customers’ names, telephone numbers, last four credit card numbers, billing addresses, and service information.

Although Verizon has determined that the implicated employee had no malicious intent, telecom workers have been accused of aiding various forms of attacks, including SIM-swapping and malware deployment.

“Unless they are leaving out a key detail, this is about as innocuous as an “insider threat breach” gets,” said Roger Grimes, data-driven defense evangelist at KnowBe4.

“One remaining question I would have is how the employee accessed the unauthorized information,” Grimes continued. “Did they simply look for it and stumble across it, or did they do something nefarious to access it?”

Insider threats are difficult to prevent because employees require a certain level of trust to perform their duties. Disgruntled and former employees and contractors with access pose the greatest risk of insider acts.

Subsequently, the Cybersecurity and Infrastructure Security Agency (CISA) advises critical infrastructure organizations to implement an insider threat mitigation program to minimize the impacts of an insider act.