A major security flaw in a leading British mobile network, Virgin Media O2, exposed the location data of millions of customers for up to two years. The vulnerability, which stemmed from improperly configured 4G software, allowed individuals to potentially track the whereabouts of mobile users.

Virgin Media O2 addressed and closed the security loophole on May 18. The flaw enabled access to information about the mobile mast a recipient was connected to during a 4G call, along with details regarding their SIM card and phone model. In densely populated urban environments, the proximity of mobile masts facilitated more precise location tracking.

An IT expert discovered the flaw in March and was able to track an acquaintance to Copenhagen. After failing to receive a response from Virgin Media O2, the expert publicly disclosed the vulnerability on a blog, prompting immediate action.

Virgin Media O2 has notified British telecommunications authorities and the data protection agency about the incident and the subsequent fix. The company, which serves 45 million mobile customers, initiated the use of the flawed software in 2023. While emphasizing that specialized knowledge was required to exploit the vulnerability, Virgin Media O2 maintains that there is no evidence of misuse of the exposed data.