UPS found that between February 2022 and April 2023, the perpetrators of the persistent SMS phishing campaign used its package look-up capabilities to obtain access to delivery information, including the recipients' personal contact information.
The company has now put protections in place to limit access to this sensitive data in order to combat these sophisticated phishing attacks.
The recipient's name, the address to which the box was being shipped, and possibly the phone number and order number were all available information through the parcel look-up facilities.
In order to maintain transparency and raise awareness of the issue, UPS will notify people whose information may have been compromised.
Source: https://heimdalsecurity.com/blog/ups-discloses-data-breach-caused-by-an-sms-phishing-campaign/
"id": "UPS134325623",
"linkid": "ups",
"type": "Data Leak",
"date": "04/2023",
"severity": "60",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"