In
a press release dated 16th
August 2021, T-Mobile confirmed the unauthorized access to some
T-Mobile data in what it tagged a highly sophisticated cyberattack; however,
T-Mobile was yet to determine whether there was any personal data breach. As a
proactive step towards concealing network security loopholes, the entry point
used to gain access was closed, and a deep technical review of the situation
across all systems immediately commenced to identify the nature of any data
that the hackers accessed illegally.
After
conducting forensic analysis and investigation into the cyberattack, T-Mobile
reported that the attackers made off with personal data of about 54
million people. The data collected include 40 million (from initial findings)
and an additional 667,000 accounts of former T-Mobile customers that were
accessed. Also, records of 13.1 million current T-Mobile postpaid customer
accounts and 850,000 active T-Mobile prepaid customer accounts were
exposed.
T-Mobile
reported that it had reset ALL the pins on the accounts and
none of the T-Mobile files stolen related to former Sprint prepaid or Boost
customers. Some of the data accessed by hackers include first and last names,
dates of birth, social security numbers, and driver’s license or ID
information. The company said no phone numbers, account numbers, passwords, or
financial information, including credit or debit card details, were
compromised.
T-Mobile has recommended and implemented the following for its customers:
- Two years of
free identity protection services with McAfee’s ID Theft Protection
Service to any person who believes they may be affected.
- All eligible
T-Mobile customers sign up for free scam-blocking protection through Scam
Shield.
- Support
customers with additional best practices and practical security steps like
resetting PINs and passwords.
- Publish a
customer support webpage that includes information and access to the above
tools at https://www.t-mobile.com/brand/data-breach-2021.
Meanwhile,
in an interview with the Wall Street Journal, the 21-year-old
hacker who claimed responsibility for the cyberattack called
T-Mobile’s security “awful”.
In
a further update by Mike Sievert, the CEO of T-Mobile, he stated that the investigation is “substantially
complete and that T-Mobile had entered long-term partnerships with the
industry-leading cybersecurity experts at Mandiant and consulting firm KPMG LLP
to build a future-forward strategy to protect T-Mobile and its customers.