[edent]

O2 used to have a responsible disclosure address - but they removed it a few years back.

When I worked there (many years ago) the security team was excellent. When I emaileld them about an issue last year, they were all gone.

[mrjeeves]

We know the relevant team within O2 was actually informed, but evidently no action (or insufficient action) was taken.