Liberia Regulator Fines Orange Liberia $20,000 Over SIM Swap Breach
The Liberia Telecommunications Authority (LTA) has imposed a LRD 4 million (approx. USD 20,000) fine on Orange Liberia after the operator improperly issued a customer’s SIM card to a third party, resulting in a privacy breach and account takeover.
The incident involved Zelah Johnson, whose mobile number was deactivated in February 2024 when her SIM was reassigned without consent. The unauthorized recipient gained access to accounts linked to her number, leaving Johnson permanently locked out.
An LTA investigation found that Orange Liberia failed to follow internal procedures and licensing obligations, violating Liberia’s Telecommunications Act of 2007 by inadequately protecting customer data and enabling unauthorized access.
In addition to the fine, the LTA ordered Orange Liberia to identify the employee responsible for the issuance and the individual who obtained the SIM. The regulator emphasized that telecom operators will face consequences for security failures that compromise customer privacy.
Orange Liberia cybersecurity rating report: https://www.rankiteo.com/company/orange-liberia
"id": "ORA1780411759",
"linkid": "orange-liberia",
"type": "Breach",
"date": "2/2024",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '1 (Zelah Johnson)',
'industry': 'Telecommunications',
'location': 'Liberia',
'name': 'Orange Liberia',
'type': 'Telecommunications Operator'}],
'attack_vector': 'Improper SIM issuance',
'data_breach': {'number_of_records_exposed': '1',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': 'Customer account access, '
'personally identifiable '
'information'},
'date_detected': '2024-02',
'description': 'The Liberia Telecommunications Authority (LTA) imposed a LRD '
'4 million (approx. USD 20,000) fine on Orange Liberia after '
'the operator improperly issued a customer’s SIM card to a '
'third party, resulting in a privacy breach and account '
'takeover. The incident involved Zelah Johnson, whose mobile '
'number was deactivated in February 2024 when her SIM was '
'reassigned without consent. The unauthorized recipient gained '
'access to accounts linked to her number, leaving Johnson '
'permanently locked out.',
'impact': {'brand_reputation_impact': 'Yes',
'data_compromised': 'Customer privacy and account access',
'financial_loss': '20000',
'identity_theft_risk': 'Yes',
'legal_liabilities': 'Fine imposed',
'operational_impact': 'Customer account lockout',
'systems_affected': 'Mobile number and linked accounts'},
'investigation_status': 'Completed',
'post_incident_analysis': {'corrective_actions': 'Identify responsible '
'employee and individual who '
'obtained the SIM',
'root_causes': 'Failure to follow internal '
'procedures and licensing '
'obligations'},
'references': [{'source': 'Liberia Telecommunications Authority (LTA)'}],
'regulatory_compliance': {'fines_imposed': 'LRD 4 million (approx. USD '
'20,000)',
'regulations_violated': 'Telecommunications Act of '
'2007',
'regulatory_notifications': 'LTA investigation and '
'order'},
'response': {'remediation_measures': 'Identify the employee responsible and '
'the individual who obtained the SIM'},
'stakeholder_advisories': 'Telecom operators will face consequences for '
'security failures that compromise customer privacy',
'title': 'Liberia Regulator Fines Orange Liberia $20,000 Over SIM Swap Breach',
'type': 'SIM Swap Attack',
'vulnerability_exploited': 'Failure to follow internal procedures and '
'licensing obligations'}