Major UK Telco Leaks User Geolocation and other metadata during calls

4G Calling is an IP product of IP Multimedia Subsystem (IMS), a standard used for Voice -over -Lte calls (volte).

Williams did not discover the mistake for long after becoming O2 customer. With the help of Network Signal Guru (NSG) in his Google Pixel 8, Williams called another user by calling a 4G -VOLTE -compatible device.

Instead of discovering details to support audio quality as intended, Williams received much more and describes the answers of the O2 session Initiation Protocol (SIP) as incredibly detailed.

“It quickly became clear to me that something was wrong. The answers that I received from the network were extremely detailed and long and were different from anything I had previously seen in other networks,” he said.

“The news contained information such as the IMS/SIP server used by O2 (Mavenir UAG) and version numbers, occasional error messages processed by the C ++ services that process call information when something went wrong and other debugging information.”

The metadata that Williams received enabled him to determine which device the call receiver used, which they used, was in the O2 network and which local area code (LAC), which they used, together with their cell -id.

Using public crowdsourced data, such as cellmapper.netWilliams was able to identify the location of the call receiver.

A second test enabled him to determine the location of an O2 customer outside of Great Britain and to determine Copenhagen, Denmark.

In cities where mobile towers are common and the cover is tight, the accuracy of the location was within 100 square meters, while in rural areas the location was wider.

William O2 UK informed this information to report the error on March 26 and 27, 2025, but did not receive an answer.

“As an O2 customer, I am extremely disappointed to see a lack of escalation routes to report this kind of potential vectors for the attack,” he wrote.

Only after he had published his report did O2 reach and confirmed that the mistake had been fixed, an assertion that William had verified.

The parent company of O2, Virgin Media, replied Bleeping computer Request for comments that confirm that the error had been patched.

“Our engineering teams have been working on for a few weeks and tests a fix. We can confirm that this is now fully implemented, and tests indicate that it has worked, and our customers do not have to take measures,” said a spokesman for Virgin Media.

O2 is one of the largest telecommunications providers in Great Britain with 5.8 million broadband and almost 23 million mobile customers across the country.