Well we did get a response from o2. No surprises in here. "It wasn't us guv". But here it is in is full narrative (o2 have confirmed I may release. .... For what it's worth)
Thank you for letting us know you’ve had a problem and for giving us a chance to help. To do this I have considered your complaint and all of the issues involved.
Having done so, I am not able to uphold your complaint. I will now explain my reasons why. My understanding of your complaint
You explain that over the past few weeks you’ve become aware that some O2 customers have received phishing emails which seem to have been sent by O2, but have actually been sent by unknown third parties. The O2 community has threads regarding this subject and some of our customers have become concerned about how this may affect them.
You’d like to know how this happened and if a breach of information security has occurred in line with our responsibilities under the Data Protection Act 1998.
My investigation
It’s unfortunate that we, like many organisations, are targeted by scammers who impersonate our company in order to try to steal sensitive information from customers. It’s always concerning for us when our customers receive phishing emails claiming to be O2. We work hard to help customers here. For example, we provide an email address for customers to report scams to us (phishing@o2.com) and we use social media to keep customers informed about particular scams. We also provide general advice and support at o2.co.uk about how to spot scams. (see below)
With the particular instance you refer to in your complaint, some of our customers have received an email which looks very much like it has been sent by O2. It has our O2 logo and even our correct head office address at the bottom of the email. The email also includes some customer information in an attempt to convince the customer it is O2. The phishing email asks customers to click on links within it to verify certain information and to access their bill. But these links do not take you to the genuine O2 web site.
As you might expect, we have specialists who investigate scams reported by customers. We also take various steps to combat scammers. Whilst, I see your letter raises a concern that “there has been a data breach either within o2 or an o2 partner.”,, please note that our investigations into these emails have found no such security breach.
In the meantime, if you receive a phishing email, the most important thing is that you don’t click on the link or reply to the email and then your personal information will stay safe. If you do receive one that appears to come from O2, please forward it to phishing@o2.com . This mailbox is monitored by our fraud team. Whilst we won’t be able to tell you who sent the email or stop them from sending more, it’s important for us to know what type of emails the fraudsters are sending so we can investigate. We will use this information to investigate and do all we can to shut down the scammers as well as co-operating with the police where appropriate.
My actions
As mentioned above I can’t uphold your complaint as we haven’t breached security. If you’ve personally received any phishing emails please send a copy to either myself or our phishing email address. My email address is (edited personal info)
Next steps
We take the subject of security very seriously and we’re constantly working hard to help prevent fraudulent activity from happening.
We have a page on our website where you can find out more about phishing emails here http://www.o2.co.uk/help/everything-else/phishing#qs and there’s also a few examples of what phishing email could look like here http://news.o2.co.uk/2014/05/29/phishing-alert-may-2014/
I hope this explains things for you. If you wish to discuss your complaint further, please contact me on 034533000683
anyway 
