{"meta":{"database":"Global Social Engineering Impact Database","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","url":"https://global-social-engineering-impact-da.vercel.app/incidents/1995-kevin-mitnick-s-telecom-pretexting-campaign-and-1995-arrest"},"incident":{"title":"Kevin Mitnick's telecom pretexting campaign and 1995 arrest","date":"1995-02-15","date_precision":"day","victim_org":"Pacific Bell, Digital Equipment Corporation and other telecommunications and computer firms","sector":"Telecom","country":"United States","primary_vector":"Physical Pretexting","secondary_vectors":["Vishing (Voice Phishing)"],"ai_involvement":"No AI reported","ai_notes":"No AI involvement; the era predates generative tooling.","outcomes":["Data Breach","Credential Theft"],"loss_usd":null,"loss_note":"Loss estimates in the case were heavily disputed at the time and are not stated here.","records_affected":null,"threat_actor":"Kevin Mitnick","summary":"Kevin Mitnick was arrested by the FBI in Raleigh, North Carolina on 15 February 1995 and found with cloned cellular phones, more than 100 cloned cellular phone codes and multiple pieces of false identification. In 1999 he pleaded guilty to four counts of wire fraud, two counts of computer fraud and one count of illegally intercepting wire communications, and admitted copying proprietary software from large cellular telephone and computer companies. He was sentenced to 46 months plus 22 months for violating supervised release. His case is the formative reference point for social engineering as a discipline.","how_it_worked":"Mitnick's intrusions leaned far more on telephone pretexting than on exploits. He would call employees while posing as a colleague from another department, a vendor engineer or an internal support technician, using accurate internal jargon, employee names and project references gathered from earlier calls and from discarded documents. Each call extracted a small, individually harmless item, a dial-in number, a system name, a temporary password reset, and those items compounded into working access. The lever was deference to apparent internal authority and the desire to be helpful to a co-worker under time pressure.","lessons":"Identity verification for any internal request must be independent of the caller's own claims, and password resets should require an out-of-band confirmation the caller cannot supply by talking.","confidence":"Reported","sources":[{"title":"Kevin Mitnick","url":"https://en.wikipedia.org/wiki/Kevin_Mitnick","publisher":"Wikipedia"}],"entry_type":"incident","slug":"1995-kevin-mitnick-s-telecom-pretexting-campaign-and-1995-arrest","year":1995,"loss_kind":null,"url":"https://global-social-engineering-impact-da.vercel.app/incidents/1995-kevin-mitnick-s-telecom-pretexting-campaign-and-1995-arrest"}}