Vodafone vodafone.is Vodafone Iceland data breach: what happened and what to do
In November 2013, attackers hit Vodafone in Iceland and published data on about 56,000 accounts. It included names, emails, phone numbers, passwords, government ID numbers, credit cards and SMS messages.
View all 13,115 breaches- Breach date
- 30 Nov 2013
- Affected
- 56,021
- Data exposed
- Credit cards, Email addresses, Government issued IDs, IP addresses, Names, Passwords, Phone numbers, Physical addresses, Purchases, SMS messages, Usernames
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In November 2013, Vodafone in Iceland was attacked by a Turkish hacker collective that also defaced the company's website. The group published the stolen data, which Have I Been Pwned (HIBP) later added to its database. HIBP counts about 56,000 accounts, drawn from several internal systems rather than one list.
The data was broader than a typical password leak. HIBP lists names, usernames, email addresses, phone numbers, physical addresses, passwords, IP addresses, credit cards, purchases, SMS messages and government issued IDs. Reporting at the time said the files held Icelandic national ID numbers and server logs, and that the passwords were encrypted.
That mix matters more than the age of the breach. A national ID number doesn't change, so it stays useful for identity fraud years later. Phone numbers plus SMS history give scammers real context for a convincing text message. Anyone who reused a Vodafone password elsewhere in 2013 and never changed it is also exposed to credential stuffing, where criminals try a leaked login on other sites.
Vodafone's response, as reported, was to work with the authorities. A decade on, the breach is mostly a reminder to check where your old details are still circulating.
If you had a Vodafone Iceland account in 2013, assume the details above are out there. Nothing can pull them back, so the useful moves are on your side: unique passwords, alerts on your credit and bank, and suspicion of any message that quotes your old data.
What to do if you were in it
- 1
Change any password you reused
If a Vodafone password from 2013 ever matched another account, change those accounts now and use a different password for each. A password manager makes this painless. Turn on two-factor authentication where it's offered.
- 2
Watch your national ID and card details
The breach included government issued IDs and credit cards. Cancel any card from that period you still use, and check your credit file in your country for accounts you don't recognize.
- 3
Expect texts that sound personal
Phone numbers and SMS history were exposed. Treat any message about your account, a parcel or a bank as suspect if it pushes you to click a link, and go to the company's own site instead.
- 4
Check whether your email or phone is in this and other breaches
Serus monitors breach databases and the dark web for your email, phone number and passwords, and alerts you when they show up. You can run a free scan at serus.ai. Serus can't remove data from a breach, but it tells you what to change.
Frequently asked
Was I affected by the Vodafone Iceland breach?
If you had a Vodafone Iceland account in 2013, possibly. Have I Been Pwned lets you search an email address against this breach, and Serus's free scan checks it alongside other breaches.
What data was exposed?
Have I Been Pwned lists names, usernames, email addresses, phone numbers, physical addresses, passwords, IP addresses, credit cards, purchases, SMS messages and government issued IDs.
Should I change my password?
Yes, if you ever reused your Vodafone password elsewhere. Change those accounts and use a unique password for each one.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
