A substantial data leak involving Be Call Group, a contact center BPO partner of TIGO Colombia, has exposed 1 GB of data containing 9.7 million records and direct connection credentials. Discover how attackers abuse third-party trust relationships and how to protect your enterprise network.
Abusing third party network connections and compromised corporate credentials of business process outsourcing (BPO) partners remains one of the most effective vectors for downstream enterprise compromise. This vector is highlighted by the recent exposure involving Be Call Group, a prominent contact center solutions provider. A threat actor has claimed to leak 1 GB of sensitive data containing 9.7 million records, internal connection configurations, and active network and email credentials. Crucially, the dataset includes direct integration and login credentials to the client applications of TIGO Colombia, a major telecommunications operator that relies on Be Call Group for support operations.
By compromising a BPO partner, threat actors can bypass the primary target's perimeter defenses entirely, leveraging trusted VPN tunnels, active API connections, and legitimate credentials. For large organizations operating in interconnected ecosystems, including enterprises across the GCC region, this incident underscores the risk of third party access management. Securing these external access points requires active defensive measures, including continuous attack surface assessments and proactive verification of partner environments.
High potential for downstream lateral movement and credential abuse.
The exposure of Be Call Group (becallgroup.com) demonstrates a textbook supply chain compromise where the ultimate objective is not just the BPO vendor itself, but its high value downstream client. Based on technical assessments of typical contact center breaches, the attack chain progresses through a highly structured sequence of initial access, credential harvesting, trusted infrastructure mapping, and data exfiltration.
In BPO and contact center environments, hundreds of remote or on site operators interact with internal platforms and partner networks daily. Attackers frequently gain a foothold by deploying information stealers (such as Lumma Stealer or AgentTesla) via highly targeted spear phishing campaigns or by exploiting vulnerable remote access gateways. Cybercriminals actively scan for exposed Remote Desktop Protocol (RDP) instances or legacy virtual private network (VPN) gateways to establish their initial connection. In regions like Latin America, threat groups such as Blind Eagle (APT-C-36) frequently utilize localized phishing lures to harvest employee session cookies and credentials.
Once inside the partner network, adversaries execute local privilege escalation and harvest active directory credentials. This yields active network and email accounts, which are then used to map internal directory servers and lateral movement vectors. In the Be Call Group incident, the harvested data included internal corporate connection profiles and email accounts, giving the threat actor a clear map of the internal system architecture and communication paths.
With administrative or high privilege credentials, threat actors target the specific integration points connecting the BPO to its enterprise clients. Since BPO agents require direct access to customer databases, billing portals, and provisioning systems, these systems are connected via dedicated VPN tunnels or API endpoints. The threat actor mapped and exfiltrated the exact configuration profiles, active API URLs, and login credentials required to access TIGO Colombia's client applications. By collecting these access parameters, the actor created a blueprint that allows subsequent attackers to masquerade as authorized BPO operators, bypassing standard anomaly detection filters.
After compressing and exfiltrating the 1 GB dataset containing 9.7 million records, the actor published the files to a public underground forum. The exposed data includes not only contact details but also the technical keys needed to interact with the downstream telecommunications application. This multi tiered risk exposes customer identities while simultaneously lowering the technical barrier for further attacks against the telecom operator's infrastructure.
Spear-phishing or remote-access vulnerability (e.g. Lumma, AgentTesla)
Gather Active Directory and internal email accounts
Identify API endpoints, credentials, and VPN configurations for TIGO
Exfiltrate 1 GB of data and publish details to cybercrime forums
Abuse trusted integrations to compromise downstream customer systems
If your team may be exposed to a similar threat, FemtoSec can help validate blast radius, prioritize remediation, and connect the issue to a practical security program.
Unauthorized actors successfully leveraged compromised third-party contractor credentials to access administrative systems of a major Canadian wireless telecommunications carrier. We analyze the attack mechanics of these supply chain breaches, mapping behaviors to the MITRE ATT&CK framework.
A newly identified malware campaign named ChocoPoC is targeting cybersecurity researchers and enterprise vulnerability management teams. By burying malicious PyPI transitive dependencies in proof-of-concept exploit repositories, the threat actors execute remote commands and exfiltrate browser credentials.
A sophisticated Adversary-in-the-Middle (AiTM) phishing framework named Blacksite, integrated with the Cloaked.gg bot evasion engine, has emerged on cybercriminal forums. Exploiting standard session validation, this service intercepts credentials and session tokens to orchestrate stealthy corporate account takeovers.
When third party contact centers are compromised, the primary risk shift is borne by the downstream client organization. The consequences of this specific leak span across several severe risk domains:
Downstream Lateral Movement: Attackers can leverage the leaked connection details and valid email credentials to launch credential stuffing or targeted phishing campaigns against the telecommunications client's internal staff.
API and Integration Exploitation: Exposed API keys and system connection profiles allow attackers to construct unauthorized queries, leading to direct data exfiltration from primary customer databases without triggering traditional perimeter alerts.
Identity Theft and Fraud: With 9.7 million records exposed, including customer contact details and network identifiers, attackers can execute highly convincing social engineering and SIM swapping attacks against the telecommunications subscriber base.
Regulatory Compliance Penalties: Compliance frameworks mandate strict control over third party processors. A breach of customer data via a partner can trigger substantial regulatory scrutiny, contractual penalties, and mandatory remediation programs.
To evaluate if your own domain has been exposed in similar BPO credential leaks or public breach archives, organizations must utilize automated validation tools.
Free exposure check
Dark Web Scanner
check dark web mentions, compromised account indicators, malware log signals, public breach exposure, and recent underground market activity for your domain.
Defenders must actively monitor for compromised BPO partner accounts and unauthorized connection attempts originating from untrusted networks. Implementing detection logic in Security Information and Event Management (SIEM) systems is critical to uncovering abnormal partner activities.
// Monitor Azure AD / Microsoft Entra ID for compromised BPO partner accounts
SigninLogs
| where UserPrincipalName has "becallgroup" or UserPrincipalName has "becall"
| where ResultType == 0 // Successful Authentication
| summarize Count=count(), UniqueIPs=dcount(IPAddress), UniqueLocations=dcount(Location) by UserPrincipalName, bin(TimeGenerated, 1h)
| where UniqueIPs > 2 or UniqueLocations > 1
| project TimeGenerated, UserPrincipalName, UniqueIPs, UniqueLocations, Count// Identify API/Portal usage using partner authentication from unapproved IP ranges
AppRequests
| where Url has "tigo" or Url has "client-app"
| where ClientIP !in ("Approved_BPO_IP_WhiteList")
| project TimeGenerated, ClientIP, Url, ResultCode, UserAgentSecurity operation centers should execute these immediate validation steps to determine exposure:
Coordinate Vendor Risk Assessments: Initiate contact with the partner security team to identify the precise systems, endpoints, and networks that were compromised during the incident.
Cross Reference Credentials: Scan active user databases for active email addresses matching the partner domains and cross reference active session logs for any anomalous access patterns.
Audit API Usage Logs: Analyze transaction logs on client facing applications to detect whether the leaked connection strings or OAuth tokens have been utilized from unapproved IP addresses.
Preventing downstream compromise requires robust architecture and strict access controls. Organizations must move away from implicit trust models when dealing with third party integrations.
Instantly terminate all active sessions associated with the compromised partner's user accounts. Force a global password reset and mandate hardware based multi factor authentication (MFA) for all remote accesses. If the partner organization does not support robust MFA protocols, their access should be suspended until compliance is verified.
All connection secrets, database credentials, API tokens, and certificate keys utilized by the BPO partner to connect to client applications must be immediately rotated. Treat any historical integration parameter as fully compromised.
Configure firewall rules and application gateways to restrict API and portal access solely to verified, static public IP addresses owned and operated by the partner. Block any connection attempts routing through commercial VPNs, hosting providers, or foreign residential proxies.
Managing third party risk requires continuous validation. GCC organizations must actively evaluate their third party attack surface, as partners often represent the weakest link in the digital supply chain. Relying solely on annual questionnaires is no longer sufficient to secure critical enterprise integrations.
By conducting continuous Attack Surface Management, enterprises can discover exposed partner assets, outdated network services, and unpatched perimeter vulnerabilities before adversaries do. Furthermore, conducting regular Red Team Operations helps organizations simulate realistic supply chain compromise scenarios, testing whether internal detection systems can identify and block lateral movement originating from trusted partner tunnels.
For ongoing exposure monitoring, deploying dedicated Dark Web Monitoring services ensures that compromised credentials, leaked database schemas, and active employee accounts are discovered and mitigated the moment they appear on cybercrime forums.