T-Mobile admits major data breach of customer information

T-Mobile notified hundreds of thousands of its customers on Friday August 20, 2021 that “a bad actor” breached their data files and obtained a wide range of information on T-Mobile customers that included social security information, names, addresses but not credit cards.

The data breach apparently took place on August 16, Monday. T-Mobile issued a press release the next day but did not notify customers until Friday, August 20.

“Our investigation is ongoing and this information may be updated. The exact personal information accessed varies by individual,” a T-Mobile post on their website announced Friday night, August 20, 2021..

“We have determined that the types of impacted information include: names, drivers’ licenses, government identification numbers, Social Security numbers, dates of birth, T-Mobile prepaid PINs (which have already been reset to protect you), addresses and phone number(s). We have no indication that personal financial or payment information, credit or debit card information, account numbers, or account passwords were accessed.”

T-Mobile data breach alert August 16, 2021

T-Mobile sent out a Text alert to its customers that read:

“T-Mobile has determined that unauthorized access to some of your information, or others on your account, has occurred, like name, address, phone number and DOB. Importantly, we have NO information that indicates your SSN, personal financial or payment information, credit/debit card information, account numbers, or account passwords were accessed. We take the protection of our customers seriously. Learn more about practices that keep your account secure and general recommendations for protecting yourself.”

The text message urged customers to visit their data breach web portal on their main website. To view the report, click here.

T-Mobile issued the following press release on Tuesday August 17:

T-Mobile Shares Additional Information Regarding Ongoing Cyberattack Investigation

August 17, 2021

As we shared yesterday, we have been urgently investigating the highly sophisticated cyberattack against T-Mobile systems, and in an effort to keep our customers and other stakeholders informed we are providing the latest information we have on this event and some additional details:

Late last week we were informed of claims made in an online forum that a bad actor had compromised T-Mobile systems. We immediately began an exhaustive investigation into these claims and brought in world-leading cybersecurity experts to help with our assessment.
We then located and immediately closed the access point that we believe was used to illegally gain entry to our servers.
Yesterday, we were able to verify that a subset of T-Mobile data had been accessed by unauthorized individuals. We also began coordination with law enforcement as our forensic investigation continued.
While our investigation is still underway and we continue to learn additional details, we have now been able to confirm that the data stolen from our systems did include some personal information.
We have no indication that the data contained in the stolen files included any customer financial information, credit card information, debit or other payment information.
Some of the data accessed did include customers’ first and last names, date of birth, SSN, and driver’s license/ID information for a subset of current and former postpay customers and prospective T-Mobile customers.
Our preliminary analysis is that approximately 7.8 million current T-Mobile postpaid customer accounts’ information appears to be contained in the stolen files, as well as just over 40 million records of former or prospective customers who had previously applied for credit with T-Mobile. Importantly, no phone numbers, account numbers, PINs, passwords, or financial information were compromised in any of these files of customers or prospective customers.
As a result of this finding, we are taking immediate steps to help protect all of the individuals who may be at risk from this cyberattack. Communications will be issued shortly to customers outlining that T-Mobile is:
- Immediately offering 2 years of free identity protection services with McAfee’s ID Theft Protection Service.
- Recommending all T-Mobile postpaid customers proactively change their PIN by going online into their T-Mobile account or calling our Customer Care team by dialing 611 on your phone. This precaution is despite the fact that we have no knowledge that any postpaid account PINs were compromised.
- Offering an extra step to protect your mobile account with our Account Takeover Protection capabilities for postpaid customers, which makes it harder for customer accounts to be fraudulently ported out and stolen.
- Publishing a unique web page later on Wednesday for one stop information and solutions to help customers take steps to further protect themselves.
  - Edited to add on 8/18: https://www.t-mobile.com/brand/data-breach-2021
At this time, we have also been able to confirm approximately 850,000 active T-Mobile prepaid customer names, phone numbers and account PINs were also exposed. We have already proactively reset ALL of the PINs on these accounts to help protect these customers, and we will be notifying accordingly right away. No Metro by T-Mobile, former Sprint prepaid, or Boost customers had their names or PINs exposed.
We have also confirmed that there was some additional information from inactive prepaid accounts accessed through prepaid billing files. No customer financial information, credit card information, debit or other payment information or SSN was in this inactive file.

We take our customers’ protection very seriously and we will continue to work around the clock on this forensic investigation to ensure we are taking care of our customers in light of this malicious attack. While our investigation is ongoing, we wanted to share these initial findings even as we may learn additional facts through our investigation that cause the details above to change or evolve.

Click here to subscribe FREE to Ray Hanania's Columns

Author
Recent Posts

Ray Hanania

Ray Hanania is an award-winning opinion columnist, author & former Chicago City Hall reporter (1977-1992). A veteran who served during the Vietnam War and the recipient of four SPJ Peter Lisagor Awards for column writing, Hanania writes weekly opinion columns on mainstream American & Chicagoland topics for the Southwest News-Herald, Des Plaines Valley News, the Regional News, The Reporter Newspapers, and Suburban Chicagoland.

His award winning columns can be found at www.HANANIA.COM Subscribe FREE today

Hanania also writes about Middle East issues for the Arab News, and The Arab Daily News criticizing government policies in the Israeli-Palestinian conflict.

Hanania was named "Best Ethnic American Columnist" by the New America Media in November 2007, and is the 2009 recipient of the SPJ National Sigma Delta Chi Award for column writing.

Email Ray Hanania at [email protected].

Follow RayHanania at Twitter