SIM-card maker Gemalto had its encryption keys stolen several years ago, but the alleged perpetrators were not some shadowy hacker group, but U.S. and U.K. spy agencies, according to a new report.
Citing top-secret documents provided by former NSA contractor turned whistleblower Edward Snowden, The Intercept said the hack was executed by the National Security Agency (NSA) and its British counterpart, the Government Communications Headquarters (GCHQ).
Gemalto, a multinational chipmaker based in The Netherlands, supplies SIM cards used by all four of the top U.S. carriers and 450 wireless network providers around the world. Access to Gemalto's encryption keys, therefore, potentially provided intelligence agencies will the ability to monitor mobile communications without approval, warrant, or wiretap, and leave no trace on the wireless provider's network, The Intercept said.
According to the site, spies from GCHQ—with support from the NSA—"mined the private communications of unwitting [Gemalto] engineers and other company employees in multiple countries."
The breach was detailed in what The Intercept called a "secret" 2010 GCHQ document, but was only just made public via the Snowden data dump.
"We cannot at this early stage verify the findings of the publication and had no prior knowledge that these agencies were conducting this operation," Gemalto said in a statement. "We take this publication very seriously and will devote all resources necessary to fully investigate and understand the scope of such sophisticated techniques."
Gemalto was not the spy agencies' only target, but in hacking the firm, "GCHQ hit the jackpot" The Intercept said.
The effort, Gemalto said. "was an attempt to try and cast the widest net possible to reach as many mobile phones as possible, with the aim to monitor mobile communications without mobile network operators and users consent."
A GCHQ spokesman declined to comment on the situation, adding that the agency follows "strict legal and policy framework" to ensure "activities are authorized, necessary and proportionate."
The NSA did not immediately respond to a request for comment.
"There have been many reported state-sponsored attacks as of late, that all have gained attention in both the media and among businesses," Gemalto said. "This truly emphasizes how serious cyber security is in this day and age."
For more, see PCMag's lineup of The 10 Most Disturbing Snowden Revelations.