We contacted all of our customers back at the time of the original Inquiry, so that was five years earlier when the original police investigation took place.

Ours was 40, slightly under.

Back when the police investigation kicked off, yes, they came to us with a specific phone number where calls had been made into voicemail retrieval numbers. We did our own identification, we identified in the region of 40 customers that we believed may have had their accounts compromised. We passed ...

The ten cases here that refer to our organisation, they are investigated by our regulatory team and they are farmed out to my investigators if appropriate, or customer services if it involves them. We send reports back to the ICO and make recommendations on what we're going to do ...

My evidence is the same as we supplied back to the committee. So since 2003 we've had 54 staff who have either been disciplined, prosecuted or dismissed for cases relating to breaches of data security. That is not purely voicemail. That could be disclosing some billing information, looking at ...

Yes.

Absolutely, yes.

Same for us. When a customer contacts us, we ask customers to have a password on their account which they need to get correct before we have a discussion with them. If they don't have the password or have forgotten it, we will go through a number of security ...

Our customer service staff have access to your billing information, the calls that you've made, but they certainly wouldn't have access to the location of your phone, that's an access they don't have and never would have had. There are people in the organisation, the same ...

No.

I wasn't aware of the Mr Nott case prior to 2005/2006. We certainly were not aware of the weakness that was being exploited within the voicemail platforms prior to the investigation. That was completely news to us and I believe to the industry, and it was at that ...

Similar to ourselves, there's lots of things in the future that may come along and be technology solutions. What we just have to be careful of is they still give customers the usability, that they actually want to use our products and services.

Also at international level with the ...

No, I think the number of digits, four, is the same as you would have with a banking card and everything. I think the challenge is getting customers to use those numbers and pick PINs that are not easily guessable.

It would count those as two, I believe. I'd have to check and come back.

It doesn't matter where they come from.

It would be the same as my previous answer. Once there's been three attempts, the account would lock.

That's been in place since 2006, following the inquiry.

After three unsuccessful attempts to get into the voicemail box, your voicemail box is locked, which means it can't be accessed for a period of 30 minutes. At the same time, a new PIN is sent to the actual registered handset, so the customer then will receive a new ...

We have comprehensive training for our staff when they join the business. They do computer based training and part of that takes them through social engineering and explains how it can happen, how we can help prevent it. We also do mystery shopping on our staff, so we actually have ...

Again the same for us. The easily guessable numbers we don't actually have PINs that you can use that relate to those numbers.

So the customer has to go in and has to actually put a unique number in before they can use the voicemail service.

In our case, it's a four digit number is the default, but until the customer has changed that to their own unique number, they cannot use the voicemail facility.

Prior to 2005, if a customer contacted us, we could reset their PIN back to the default and then the customer could choose their new PIN. So at no stage would we know what the PIN actually was. We would purely reset it back to default and the customer could ...

That's correct, yes.

Yes.

We previously had a default PIN that was sent to customers and it was down to the customer if they wanted to change that default PIN or leave it at default and that was the case until 2005/2006 when we had the voicemail issue and it was at that ...

Yes.

Yes, it is.

I'm the head of fraud and security for Telefonica O2, I've been in that role for ten years and have been in the industry for 13.