Telefonica owned UK mobile operator O2 was this morning caught in a storm when a user discovered that his phone number was being sent to websites he visited when roaming through O2′s network.

System Administrator Lewis Peckover discovered the data and privacy breach when building a site and wanting to know the information that was being sent and possibly collected while browsing on a mobile network.

After alerting O2 yesterday 24 January at 15.12 through Twitter it took the mobile operator nearly four hours to ask @lewispeckover for a screenshot.  This request followed a previous tweet where the company tried to reassure him by stating that ‘the mobile number in the HTML is linked to how the site determines that your browsing from a mobile device‘.

This issue went public this morning when people bombarded O2 for answers, forcing the company to issue it’s first statement at 08.49 by stating ‘we are investigating this at the moment and will update everyone as soon as possible.’

This breach in privacy creates a massive concern not just for consumers but businesses that use O2 for data roaming as sending users numbers might enable bots to harvest these for spam.

Twitter users have already been calling for O2 to be reported to both Ofcom and the Information Commissioner’s Office (IOC).

To check if you are affected switch to 3G and use the following script developed by Lewis Peckover to see if your own UK or International overseas cellular network sends your number.

This story is developing.

Wednesday, 25 January – 15.40: O2 has tweeted at 15.32 a statement saying, ‘We’re sorry about the concern re mobile numbers and web browsing, which is now fixed. Here’s what happened + Q&A.‘  They included a link to a Q&A in their blog: http://tfs.me/wdekaS