Bug Bounty Hunter Ran ISP Doxing Service
Summary: A Connecticut man named Ryan Stevenson, who received bug bounty rewards and public recognition from T-Mobile and AT&T for reporting website vulnerabilities, also ran a service on the OGusers forum that sold customer records from major U.S. carriers for $25 per record in bitcoin. Stevenson acknowledged running the ISP doxing service but said his forum account was banned and few took up the offer, and he denied involvement in SIM swapping attacks.
Why it matters: The same person paid $1,000 by T-Mobile for finding a flaw that exposed customer addresses and account PINs was advertising lookups against Verizon, AT&T, Sprint, T-Mobile, MetroPCS and Boost Mobile for $25 a record, and investigators told a $100,000 SIM-swap victim that attackers reached his T-Mobile account through software giving backdoor access to the carrier's customer database.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026