Virgin Mobile free Virgin Blue flight promo reveals customer details.
It appears that a basic security flaw on the Virgin Mobile website has exposed customers’ personal details including their name, address, date of birth and phone number.
The Virgin Mobile promotion offering customers a free domestic return flight on Virgin Blue [please note that this was not a Virgin Blue promotion and did not involve Virgin Blue customer information being exposed] if they bought a handset on a plan from the operator was apparently taken up by thousands and in order to claim the flight, customers had to register their details on the Virgin Mobile website, wait for an SMS containing a six character “free flight SMS code” and then enter that code on the Virgin Mobile website.
The customer could then review their personal details and submit a claim form for their free flight, but this is where it all went wrong!
An anonymous Sydney Morning Herald reader who took part in the promotion discovered that, using a simple workaround, they could gain access to the personal details of others who registered for the promotion, adding, “When I attempted to enter my ‘Free flight SMS code’ at the above address I entered the last character incorrectly”. “Instead of my details appearing on the page, someone else’s details appeared – including their name, address, phone number and date of birth.”
It appears that, instead of using random SMS codes, Virgin Mobile’s codes were sequential so simply changing the last character allowed access to a new set of personal details.
For example, someone who received the code “00XM7Z” could view another customer’s details by entering “00XM7Y” or “00XM7X”, etc.
The reader said, “They have chosen to protect mine and the details of others via a system that would probably not even offer protection against a curious 7 year old (let alone an experienced and devious identity thief)”.
“I feel angry and worried that my details have been compromised. I am appalled that such a sloppy system could have been developed in this day and age.
A Virgin Mobile spokeswoman said the issue was being investigated, and any security flaws had now been plugged, adding, Virgin Mobile had contracted a third party to run the promotion but would not divulge the company’s name.
“We have now amended this website so that customers need to enter their surname as well as their unique code to click through”.
Despite admitting that thousands of people had taken part in the promotion, the spokeswoman said only 50 customers’ personal details were exposed, saying, “Virgin Mobile prides itself on our customer service and it was not our intentions to release any sensitive details on any of our customers.” “This has now been changed to ensure it will not happen again.”
A spokesman for the privacy commissioner, Karen Curtis, could not be reached for comment, but usually, a formal complaint needs to be made before privacy issues such as these are investigated any further.
Report by The Mole with some material from The Sydney Morning Herald
John Alwyn-Jones
Vegas’s Billion-Dollar Secrets – What They Don’t Want Tourists to Know
Visit Florida’s New CEO Bryan Griffin Shares His Vision for State Tourism with Graham
Chicago’s Tourism Renaissance: Graham Interviews Kristin Reynolds of Choose Chicago
Graham Talks with Cassandra McCauley of MMGY NextFactor About the Latest Industry Research
Destination International’s Andreas Weissenborn: Research, Advocacy, and Destination Impact
Graham and Don Welsh Discuss the Success of Destinations International’s Annual Conference
Graham and CEO Andre Kiwitz on Ventura Travel’s UK Move and Recruitment for the Role
Brett Laiken and Graham Discuss Florida’s Tourism Momentum and Global Appeal
Graham and Elliot Ferguson on Positioning DC as a Cultural and Inclusive Global Destination
Graham Talks to Fraser Last About His England-to-Ireland Trek for Mental Health Awareness
Kathy Nelson Tells Graham About the Honour of Hosting the World Cup and Kansas City’s Future
Graham McKenzie on Sir Richie Richardson’s Dual Passion for Golf and His Homeland, Antigua
ADS PRO 
France prepares for a massive strike across all transports on September 18
Turkish tourism stalls due to soaring prices for accommodation and food
CCS Insight: eSIMs ready to take the travel world by storm
Germany new European Entry/Exit System limited to a single airport on October 12, 2025
Airlines suspend Madagascar services following unrest and army revolt