> series: anatomy_of_a_breach —— part: 031 —— target: thousands_of_voicemail_accounts —— method: default_pins —— consequence: newspaper_closed<span class="cursor-blink">_</span>_
The News of the World phone hacking scandal was not a cyberattack in the conventional sense — there were no servers compromised, no malware deployed, no vulnerabilities exploited in software. Instead, journalists and private investigators working for the News of the World, a News International (now News UK) newspaper, systematically accessed the voicemail accounts of thousands of people by exploiting the simplest of security failures: mobile phone voicemail systems protected only by default PINs that users had never changed.
The scale was staggering. Victims included celebrities, politicians, members of the Royal Family, crime victims, and — most shockingly — the family of murdered schoolgirl Milly Dowler, whose voicemail was accessed while she was still missing, giving her parents false hope that she was alive. The revelations, which had been building since 2006 but reached a crisis in July 2011, led to the closure of the 168-year-old newspaper, the Leveson Inquiry into press ethics, criminal prosecutions (including the imprisonment of former editor Andy Coulson), and a fundamental reassessment of communications privacy in the UK.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallThe 'hacking' technique was devastatingly simple. Mobile phone voicemail systems allowed remote access — users could call their own number from any phone and enter a PIN to listen to messages. The PINs were typically set to a default value (such as 0000 or 1234) by the network operator, and most users never changed them. By calling a target's mobile number, selecting the voicemail option, and entering the default PIN, anyone could listen to private voicemail messages.
The phone hacking scandal is the most visible consequence of default credentials in UK history — but the underlying vulnerability is universal. Every device, system, and platform deployed with a default password is vulnerable to the same exploitation. Our infrastructure penetration testing systematically checks for default credentials across routers, switches, firewalls, printers, IoT devices, management interfaces, and application platforms. We find them in almost every engagement.
Cyber Essentials certification requires that all default passwords are changed before deployment — a control that, had it been applied to voicemail PINs, would have prevented the entire phone hacking scandal. For ongoing monitoring that detects the use of default credentials on your network, SOC in a Box provides continuous vulnerability detection. And for incident response when communications interception is suspected, UK Cyber Defence provides the forensic investigation capability.
Our <a href="/penetration-testing/infrastructure">penetration testing</a> checks every device on your network for default credentials. <a href="/cyber-essentials">Cyber Essentials</a> mandates that defaults are changed. Because the most expensive breach in UK media history started with a four-digit PIN that nobody bothered to change.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call