O2 Fixes Bug that Sends Users' Phone Numbers to Websites

That was fast.

O2 has said that it has identified and fixed a bug that sends users' phones numbers to the websites they visit while browsing the web. The problem was spotted by Lewis Peckover of London and first reported by The Next Web. According to the TNW, Peckover noticed the problem and then created a webpage to check the information that a mobile browser would send to a website when it requested data. He found that while most of the data being transmitted was routine (Host, User Agent, Referrer and Encoding), there was a field in the results called x-up-calling-line-id that pointed to the user's phone number.

Just a few hours after word got out, O2 released a statement detailing the issue and assuring users that it has been fixed.

"We have seen the report published this morning suggesting the potential for disclosure of customers’ mobile phone numbers to website owners," the company wrote on its blog. "We investigated, identified and fixed it this afternoon. We would like to apologise for the concern we have caused."

The mobile phone provider then went on to explain that the issue revolves around O2's sharing of user phone numbers with 'certain trusted partners' for various reasons (age verification, premium content billing, and O2's own services). However, between 10th of January and 1400 on the 25th of January, sites other than than O2's 'trusted partners' have been seeing users' phone numbers. Or, as O2 puts it, "In addition to the usual trusted partners, there has been the potential for disclosure of customers' mobile phone numbers to further website owners."

O2 blames technical changes it implemented as part of routine maintenance for the problem and says any customers that accessed the internet outside of WiFi and inside the above time-frame is affected. The network says it is working with the Information Commissioner's office, which has launched an investigation, and has spoken with OFCOM.