Kyivstar sold an eSIM to a journalist with access to other people’s personal data—correspondence, contacts, and social networks.
9 January 11:31
Journalist Vitaliy Ulybin reported a serious incident involving personal data security while using an eSIM from mobile operator Kyivstar. According to him, the purchased number turned out to be linked to the accounts of another person—a resident of Donetsk, reports "Komersant Ukrainian".
According to the journalist, he purchased an eSIM for his work phone using a contactless activation service. After installing the basic applications, there were no problems, but when he logged into Telegram, the system automatically opened someone else’s profile.
“But instead of starting to set up my profile, I realize that my name is now Anuta, I actively follow public pages about ‘esveo’, save recipes for hake in tomatoes, and spam people with Viber messages. Here are conversations with minor children, my mother, some people, simple folks, relatives, and kindred spirits,” Ulybin said.
The journalist notes that he checked the account’s activity and came to the conclusion that the owner of the number continues to use the messenger, unaware that an outsider has gained access to her private life.
According to Ulybin, the incident indicates a systemic problem with the protection of subscribers’ personal data.
“This means that not only Anuta’s private life, but anyone’s private life can accidentally end up in someone else’s hands. With correspondence, photos, whether pious or not, and a list of contacts. And that’s not very cool,” he emphasizes.
The reaction of Kyivstar’s support service caused particular outrage. According to the journalist, after contacting the operator, he was advised to visit a physical store for a free eSIM replacement.
“I chose this service precisely so that I wouldn’t have to stand in line and waste time, which is already in short supply. If you’ve created a contactless service, then why can’t you fix a screw-up contactlessly as well? Give me my money back, for example, deactivate the number so that I can buy a new one. Why can’t the operator resolve this issue manually by phone — she has different access to the system than the salespeople in the store?” notes Ulybin.
The cost of the eSIM was 700 hryvnia, and additional fees were paid for activating the services. As a result, the journalist reports financial losses, several days of downtime for his work phone, and the risk of personal data leakage to a third party.
Kyivstar commented on the situation as follows:
“Vitaliy Ulybin, numbers have an expiration date, and when it expires, the number is canceled and may subsequently be put up for sale. This happens because the number capacity is not infinite, and the previous owner did not deactivate their account in the messenger. Anastasia,” the company said in a comment on the journalist’s post.
Vitaliy Ulybin replied:
“Kyivstar, the question was that you provide a contactless service, and when it turns out to be of poor quality, instead of offering the best solution, you send the person to the store. If I wanted to buy a number in a store, I would probably go there right away.”
