The National Crime Agency is investigating the breach and said that three people have been arrested, two for computer misuse and one for perverting the course of justice.

A spokesman for Three said: "Over the last four weeks Three has seen an increasing level of attempted handset fraud. This has been visible through higher levels of burglaries of retail stores and attempts to unlawfully intercept upgrade devices.

"We’ve been working closely with the Police and relevant authorities. To date, we have confirmed approximately 400 high value handsets have been stolen through burglaries and eight devices have been illegally obtained through the upgrade activity.

"The investigation is ongoing and we have taken a number of steps to further strengthen our controls.

"In order to commit this type of upgrade handset fraud, the perpetrators used authorised logins to Three’s upgrade system.

"This upgrade system does not include any customer payment, card information or bank account information."

Three has over nine million customers and it is understood that hackers, who used company access codes to get into the system, had access to large parts of the upgrade database.

The theft will prompt concerns that personal information of millions of customers could be sold online to criminals.

A spokesman for the National Crime Agency said: "On Wednesday 16 November 2016, officers from the National Crime Agency arrested a 48-year old man from Orpington, Kent and a 39-year old man from Ashton-under-Lyne, Manchester on suspicion of computer misuse offences, and a 35-year old man from Moston, Manchester on suspicion of attempting to pervert the course of justice.

“All three have since been released on bail pending further enquiries. As investigations are on-going no further information will be provided at this time”.

Three was founded in 2003 and employs over 4,000 people in the UK. The network carries over 37 per cent of all the UK's mobile phone data.

This latest data breach follows a similar hack at Talk Talk where the details of more than 150,000 customers were stolen including the bank account details of around 15,000.

The company lost 95,000 subscribers as a result of the attack, which cost it £60million.

A 17 year old boy pleased guilty to seven counts of breaching the Computer Misuse Act 1990 at Norwich Crown Court earlier this week.</s>Three’s UK network has been hit by a major data breach that could have exposed the personal details of millions of customers.

However, Irish customers of the mobile network have not been affected by the attack on the customer upgrade database, which is believed to have been carried out using compromised employee log-ins.

“Three Ireland is not affected. The system impacted is used solely by Three UK,” a spokeswoman for the Irish network said.

The UK network said it was still looking into how many of its nine million customers had been affected. The affected database did not contain customers’ financial details, a spokesman for Three UK said. However, it did contain personal data such a names and addresses.

That information was used to apply for upgraded handsets for a number of customers, which were then intercepted.

Three men have been arrested in connection with the breach.</s>Customer information from more than 130,000 users of the Three mobile network has been compromised in a cyber security breach, the mobile operator has said.



Three boss, Dave Dyson, said in a statement that all affected customers were being contacted individually and that while personal information had been accessed, no financial information had been compromised.

Three men were arrested after the data breach was revealed, over the alleged fraudulent use of the company’s phone upgrade system in an attempt to steal handsets.

Dyson said: “As you may already know, we recently became aware of suspicious activity on the system we use to upgrade existing customers to new devices and I wanted to update all our customers on what happened and what we have done.

“On 17 November we were able to confirm that eight customers had been unlawfully upgraded to a new device by fraudsters who intended to intercept and sell on those devices. I can now confirm that the people carrying out this activity were also able to obtain some customer information.

“In total, information from 133,827 customer accounts was obtained but no bank details, passwords, pin numbers, payment information or credit/debit card information are stored on the upgrade system in question. We believe the primary purpose of this was not to steal customer information but was criminal activity to acquire new handsets fraudulently.”

Three said it was continuing to work with law enforcement agencies, and as a precaution additional security measures had been placed on customer accounts.

The company had been criticised by some customers on social media for what was seen as a muted response to the breach. However, Dyson said Three would address all consumer concerns.

“I understand that our customers will be concerned about this issue and I would like to apologise for this and any inconvenience this has caused,” he said. “We are contacting all of these customers today to individually confirm what information has been accessed and directly answer any questions they have.”

Security experts have again called for major companies with large amounts of customer data to do more to protect consumers. The breach is the latest in a string of cyber attacks and data breaches, including those on TalkTalk and Yahoo.
The Three UK mobile phone company admits that there has been a cyber-security breach involving the details of millions of customers.