Security News > 2021 > August > T-Mobile: >40 Million Customers’ Data Stolen

On Tuesday, it disclosed further details on the data breach in a post on its website, saying that the breach affects as many as 7.8 million postpaid subscribers, 850,000 prepaid customers and "Just over" 40 million past or prospective customers who've applied for credit with T-Mobile.

Compromised payment data may not have shown up in T-Mobile's investigation, but personal information did: As of 01:54 Wednesday morning, T-Mobile had ascertained that the ripped-off data included customers' first and last names, date of birth, Social Security numbers, and driver's license/ID information "For a subset of current and former postpay customers and prospective T-Mobile customers."

The telecommunications bigwig said that it first learned late last week about claims, posted to an underground forum, that threat actor(s) had stolen over 100 million customer records and were offering 30 million for sale for the surprisingly cheap cost of 6 bitcoin, or about 1 cent per record.

According to preliminary analysis, about 7.8 million current T-Mobile postpaid customer accounts' information were in the stolen files, plus over 40 million records of former or prospective customers who had previously applied for credit with T-Mobile.

No phone numbers, account numbers, PINs, passwords, or financial information were compromised in any of the stolen records pertaining to customers or prospective customers, Not so for prepaid customers, though: There were security PINs for 850,000 prepaid customers involved, T-Mobile said in its update: "At this time, we have also been able to confirm approximately 850,000 active T-Mobile prepaid customer names, phone numbers and account PINs were also exposed."

2019: about 1.26 million of T-Mobile's prepaid were affected by a breach that included names, billing addresses, phone numbers, account numbers and CPNI. 2020: An undetermined number of employees and customers were affected when attackers accessed employee email accounts, some of which contained account information for T-Mobile customers, including names and addresses, phone numbers, account numbers and more.

News URL

https://threatpost.com/t-mobile-40-million-customers-data-stolen/168778/