In August this year, T-Mobile suffered one of the biggest data breaches ever in the wireless industry. It compromised data from over 50 million current and former customers of the self-proclaimed Un-carrier. While the company may have yet to recover from this, it has been hit with yet another data breach. The latest breach appears to be of a significantly smaller scale but it surely doesn’t help T-Mobile’s reputation.
According to The T-Mo Report, which has got hold of some internal T-Mobile documents, the company has noticed “unauthorized activity” on a “small number” of customer accounts earlier this month. The documents reveal that some customers had their customer proprietary network information (CPNI) accessed and presumably stolen in this leak. This could include the billing account name, phone number, number of lines on the account, T-Mobile account number, and rate plan details.
Additionally, some other customers were hit with an unauthorized SIM swap due to this breach. Meaning, they had their phone number taken over by someone else, and surely not with good faith. This poses a risk to their other online accounts as well. Since the malicious actor has access to their phone number, they can use two-factor authentication (2FA) to access linked accounts. This could lead to catastrophic consequences.
T-Mobile’s internal documents reveal that a subset of the affected customers had to suffer both breaches— leaked CPNI and unauthorized SIM swap. The company says its offline teams have since reversed all unauthorized SIM swaps that originated from the latest data breach. It has also notified all the affected customers and provided them with the necessary details. But the damage may have already been done. Hopefully, no one has had to suffer serious damages.
T-Mobile has yet to publicly acknowledge the latest data breach
At the time of this writing, T-Mobile hasn’t publicly acknowledged the latest data breach. Of course, this leak isn’t as extensive as the one that happened a few months back. The previous breach had compromised the social security numbers and other personal identification data of the affected customers. That breach was so huge that it prompted the FCC to launch an investigation.
However, a second data breach in just over four months, and the third in less than a year, do point fingers towards the security measures of T-Mobile. Hopefully, the company is investigating this breach and will publicly share some details on it in the coming weeks.
2021-12-29 15:06:22