UK ISP Wanadoo has fixed a serious security problem that exposed the account information of many of its subscribers.

The flaw arose because its web servers were incorrectly configured, thereby allowing users to view the contents of an entire folder instead of just an index web page.

Because of this index browsing flaw, it was possible for snoops to uncover the real name, user name, password, email address, and web space sub domain of listed customers from the affected account recovery system web servers. No authentication would have been required to retrieve this data.

Postings on a Wanadoo user forum suggest the issue has existed for more than two years. However, there is no evidence that it has been exploited by hackers.

After the flaw came to light last weekend, Wanadoo acted to investigate the problem and roll out a fix.

In a statement, the ISP said: "Wanadoo can confirm that a small number of links to files containing customer details have been posted on the internet. Wanadoo would like to reassure customers that this was an isolated incident and as soon as we were made aware of the problem, the information was removed from the public domain.

"We are alerting those customers involved, advising them to change their password details. Our customers’ security is paramount and we take this situation extremely seriously. An investigation is currently taking place to uncover how this happened and ensure that this does not happen again." ®

Related stories

• Tesco in customer receipt security breach (12 December 2006)
• Orange broadband punters left stranded for weeks (11 August 2006)
• Orange confirms 'free' broadband giveaway (31 May 2006)
• Blue Security calls it quits after attack by renegade spammer (17 May 2006)
• Tiscali in UK consumer data security breach (26 September 2005)
• NY enacts security breaches disclosure law (12 August 2005)
• Unauthorised research opened door to MasterCard breach (21 June 2005)
• AOL rebuts zombie network slur (16 June 2005)