STE WILLIAMS

Updated The parent firm of directory enquiry service 118 118 has yanked offline its finance division’s website after detecting unauthorised access by a person or persons unknown, The Register can reveal.

118 118 Money wrote to personal loans and credit card customers on 23 March to confirm the intrusion, saying in the letter – seen by us – that it is trying to ascertain what happened.

The letter states:

We have taken our network offline temporarily while we investigate an unauthorised access to our systems. Our team is working urgently to restore our normal functions and will provide updates as soon as we able.

The mandatory apology for the inconvenience was issued, though there was no detail on whether any data has been snatched in the digital burglary.

“Credit card customers can continue to use their cards as normal. However, for the time being, we will not be processing new applications,” the letter added.

Any punter who wants to contact 118 118 Money about their loans or credit card can use the chat function at the bottom of the mail it sent to customers, or they can call 08000 118 222.

“Given the high volume of calls at this time, customers may experience longer than normal wait times,” the letter ended. Current working hours, it should be noted, are 11am to 5pm.

We have asked 118 118 Money if it had additional comment on the type of attack and whether ransomware was involved; when it spotted the intrusion and how entry was gained; and the sorts of data exposed.

Professor Alan Woodward of the University of Surrey told us: “We cannot assume the criminals will cut anyone any slack in the current situation, so those phishing emails, watering hole attacks, and so on will continue.”

Although not commenting specifically on the 118 118 Money incident, he said that in recent ransomware attacks, hackers “grabbed data as well as locking up systems,” and this gave them two “levers” to “extort money”.

The personal loans business was launched by US parent group kgb (a privately held, New York-based company) in 2013. In its latest full accounts on Companies House – for the year ended 31 December 2018 – Madison CF UK Ltd, which trades under the name of 118 118 Money, earned £62.929m in interest income, and accrued a £1.559m tax benefit due to an £8.14m loss before taxation, leaving it with a total comprehensive loss of £6.57m. It received a similar amount in tax benefit in the year ended 2017, when it declared a total loss of £6.72m.

Its fellow subsidiaries in the UK include 118 Ltd, which provides outsourced services support for other firms, mostly from the healthcare sector, and The Number UK Ltd, which provides directory assistance.

118 118 Money started off providing loans to Brits of £1,000 to £5,000 that carried annual interest rates of between 36 and 80 per cent. Among its target market were people with a low credit score.

The credit card side was launched in 2018 with customers charged a monthly subscription fee based on a credit limit. No interest is charged. However, folks at This is Money have pointed out that the monthly fees are the equivalent of high interest annual percentage rates compared to the average credit card. The minimum income requirement to get the 118 credit card is £8,400.

The 118 118 Money website remains down for a second day.

Updated at 14.44GMT on 24 March to add:

118 118 Money made contact following publication of the article but sent us the same statement that it distributed to customers. It refused to make any further comment at this stage. ®

Sponsored:
Webcast: Why you need managed detection and response

Article source: https://go.theregister.co.uk/feed/www.theregister.co.uk/2020/03/24/got_yuor_number_maybe_118/