Skip to main content

Xfinity irresponsibly using 0000 as default PIN, hacker steals customer’s phone number and buys a Mac

In the latest episode of consumers affected by tech companies’ security flaws, Comcast’s Xfinity Mobile wireless service was found to be setting customer PINs by default to 0000. As reported by The Washington Post (via The Verge) one of the users who had their phone number stolen because of Xfinity’s weak PIN default even saw a hacker purchase an Apple computer with his credit card.

In this instance, somehow the hacker was able to use the credit attached to the victim’s Xfinity Mobile account, which remained on file after the phone number was stolen. Comcast confirmed this story to The Washington Post.

The hacked user, from California, told the Post he had his phone number hijacked and transferred to a new account, with his credit card still attached to the new phone. The hacker then used the card to buy a new Apple computer in Georgia.

The Verge notes that once a number has been transferred to another carrier, Xfinity Mobile likely has no power to help victims.

On Xfinity forums, one user who said his number was ported noted that Comcast told him to file a police report, but the company then didn’t help him get the number back to his account, possibly because the number was already with another carrier that Comcast had no control over. Another user pointed out that two-factor authentication wouldn’t help in this case, as it wouldn’t prevent a hacker from porting out the number.

It’s unclear how many users have had their phone numbers stolen because of this oversight, but Comcast says it’s “very small.”

“We’re aware of a very small number of customers impacted by this issue, but even having one customer impacted by this is one too many,” a Comcast spokesperson tells the Verge. The company said it had added more security around porting phone numbers to new accounts and is also “working aggressively towards a PIN-based solution.” It’s also reaching out to affected customers to help fix the issue on a case-by-case basis.

However, a still lingering question is why Xfinity Mobile was using 0000 as the default PINs for customers in the first place.

Late last year, Kanye West accidentally exposed that he used a similar password, 000000, for his iPhone.

FTC: We use income earning auto affiliate links. More.

You’re reading 9to5Mac — experts who break news about Apple and its surrounding ecosystem, day after day. Be sure to check out our homepage for all the latest news, and follow 9to5Mac on Twitter, Facebook, and LinkedIn to stay in the loop. Don’t know where to start? Check out our exclusive stories, reviews, how-tos, and subscribe to our YouTube channel

Check out 9to5Mac on YouTube for more Apple news:

Comments

Author

Avatar for Michael Potuck Michael Potuck

Michael is an editor for 9to5Mac. Since joining in 2016 he has written more than 3,000 articles including breaking news, reviews, and detailed comparisons and tutorials.