The Telecom­mu­ni­ca­tions Au­thor­i­ty of Trinidad and To­ba­go (TATT)says it is “dis­turbed” by the da­ta breach­es at the Telecom­mu­ni­ca­tions Ser­vices of T&T (TSTT).

TATT, the reg­u­la­to­ry body for the telecom­mu­ni­ca­tions sec­tor in the coun­try, yes­ter­day said it was mind­ful of the po­ten­tial ad­verse im­pli­ca­tions this mat­ter may have on con­sumer con­fi­den­tial­i­ty.

TATT said it had been in dis­cus­sion with TSTT on what tran­spired and mea­sures to be in­tro­duced to pre­vent a re­cur­rence.

It al­so rec­om­mend­ed, as a pre­cau­tion­ary mea­sure to re­duce pos­si­ble ex­po­sure, that con­sumers should adopt the prac­tice of not sav­ing their pass­words, and cred­it and deb­it card da­ta to web­sites.

TSTT yes­ter­day ad­mit­ted that da­ta was ob­tained by cy­ber­at­tack­ers on Oc­to­ber 9. Ini­tial­ly, the com­pa­ny said there was no com­pro­mise of cus­tomer da­ta but added that it had not cor­rob­o­rat­ed in­for­ma­tion in the pub­lic do­main pur­port­ed to be cus­tomer in­for­ma­tion.

TSTT yes­ter­day said 6GB, or less than one per cent of the petabytes of the com­pa­ny’s da­ta, was ac­cessed.

How­ev­er, it not­ed that the ma­jor­i­ty of its cus­tomers’ da­ta was not ac­quired and no pass­words were com­pro­mised.

TSTT al­so said it was de­ter­mined that some of the da­ta had been ac­cessed from a lega­cy sys­tem, which is no longer utilised but con­tains da­ta that is, in many in­stances, no longer valid.

This da­ta is kept to en­sure TSTT is com­pli­ant with rel­e­vant laws as it re­lates to the re­ten­tion of cus­tomer in­for­ma­tion.

It stat­ed in its re­lease that with this con­text, the sub­set of in­for­ma­tion ac­cessed con­tains the fol­low­ing pa­ra­me­ters:

What is in­clud­ed is the first name; call records; last name; email ad­dress; home ad­dress; ID Scans (lim­it­ed amount); some cus­tomer ac­count in­for­ma­tion, (Ac­count #, billing ad­dress­es, and some mo­bile num­bers); let­ters of au­tho­ri­sa­tion: this per­mits some­one to con­duct trans­ac­tions with TSTT on some­one’s be­half and pay­ment re­ceipts.

What is not in­clud­ed, TSTT not­ed, are call records; trans­ac­tion­al da­ta, cus­tomer pass­words, cred­it card in­for­ma­tion, and fi­nan­cial in­for­ma­tion.

TSTT al­so ad­dressed what it called false, mis­lead­ing, and dam­ag­ing state­ments re­gard­ing its da­ta cen­tre. It said its da­ta cen­tre is the most se­cure, re­silient and re­li­able da­ta cen­tre in T&T and the Caribbean, and ranked high­ly in the Latin Amer­i­can re­gion.

The telecom­mu­ni­ca­tions com­pa­ny al­so re­fut­ed claims that its da­ta cen­tre was breached. It said any claims of its cor­po­rate client da­ta or cre­den­tials be­ing ac­cessed as a re­sult of an al­leged breach of the da­ta cen­tre is “in­ac­cu­rate, ill-in­formed, and mis­chie­vous”.

‘This could have been avoid­ed’

But Com­mu­ni­ca­tions Work­ers’ Union sec­re­tary gen­er­al Clyde El­der, who ini­tial­ly told the pub­lic about the cy­ber­at­tack, said TSTT should have been truth­ful from the on­set in­stead of “danc­ing around the pub­lic”.

El­der said many cy­ber ex­perts warned the com­pa­ny about this at­tack but he claimed TSTT’s man­age­ment did not heed the call.

“Sev­er­al tech-savvy per­sons went and found the da­ta and re­alised that TSTT has been ly­ing to the pub­lic and TSTT is now forced to is­sue an­oth­er re­lease try­ing to down­play what the pub­lic al­ready knows. So, cus­tomers’ IDs, home ad­dress­es, and fi­nan­cial in­for­ma­tion is out there. This could have been avoid­ed,” he lament­ed.

El­der again called on the Gov­ern­ment to fire TSTT’s ex­ec­u­tives Shi­va Ram­nar­ine and Lisa Agard for this breach.

Al­so con­tact­ed yes­ter­day, An­gus Smith, man­ag­er of the T&T Cy­ber Se­cu­ri­ty In­ci­dent Re­sponse Team, said with the cy­ber ter­ror­ists gain­ing ac­cess to some cus­tomers’ in­for­ma­tion, pre­cau­tion­ary mea­sures must be tak­en.

“One may not have made their ad­dress, phone num­ber, and email avail­able to any­one. They would just have to take pre­cau­tions to en­sure that any­thing sus­pi­cious or any­body tried to con­tact them, they just have to be care­ful and be mind­ful of that,” Smith ex­plained.

He said he was un­able to say whether a breach oc­curred, how­ev­er, as there was not enough in­for­ma­tion to say with cer­tain­ty.

Mean­while, Princes Town MP Bar­ry Padarath said TSTT must treat the mat­ter with a sense of ur­gency to pro­tect cus­tomers.

He said, “They can­not bury their heads in the sand and refuse to pro­vide clear co­her­ent an­swers on what has oc­curred and what steps are be­ing tak­en to ex­pe­di­tious­ly mit­i­gate the ef­fects.”

Padarath al­so called on the Gov­ern­ment, which is the ma­jor­i­ty share­hold­er of TSTT, to pro­vide strong lead­er­ship on the in­ci­dent and en­sure that in­ter­na­tion­al in­dus­try stan­dards are met to stop fur­ther at­tacks and to se­cure pri­vate and con­fi­den­tial in­for­ma­tion host­ed by TSTT.

Ef­forts to reach the Pub­lic Util­i­ties Min­is­ter Mar­vin Gon­za­les were un­suc­cess­ful.