ENKR

T-Mobile cyberattack and data theft

Add to my breach check

Made public · 76,600,000 people

What leaked9

Replaceable

  • Mobile account PIN
  • IMSI

Hard to replace

  • Phone IMEI
  • Driver's licence number
  • Mobile number
  • Home or delivery address

Permanent

  • Social Security number
  • Date of birth
  • Full name
  • Mobile account PINaccount PINs of about 850,000 active prepaid customers; T-Mobile reset them
  • Social Security number7.8 million current customers and about 40 million former or prospective customers
  • Driver's licence numberdriver's licence or ID number

To-dos10 · about 2 h in all

  1. Freeze your credit at Equifax, Experian and TransUnionabout 30 minfreeStops: credit in your name (opens in a new tab)
  2. Get an IRS Identity Protection PINabout 20 minStops: tax refund fraud (opens in a new tab)
  3. Turn on instant transaction alertsabout 5 minHelps you notice: bank account fraud, scam calls
  4. Place a fraud alert on your credit reportsabout 10 minfreeLimits harm from: credit in your name (opens in a new tab)
  5. Check your credit reports every week, freeabout 20 minfreeHelps you notice: credit in your name (opens in a new tab)
5 more
  1. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  2. Turn on your carrier's port-out lockabout 5 minLimits harm from: SIM swap
  3. Turn on your carrier's SIM-change lockabout 5 minLimits harm from: SIM swap
  4. Freeze your NCTUE phone and utility fileabout 10 minfreeLimits harm from: phone or utility account (opens in a new tab)
  5. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home

What happened next16 events

  1. UndetectedNone on record
  2. Response 9 eventsNo individual notice on record · show events
  3. Remedy 3 eventsEnded · show events
  4. Penalty 2 eventsFine $15.8M · show events
  5. Disputes 2 eventsSettled · show events
  1. FCC consent decree: T-Mobile had not identified any fraudulent activity relating to the data taken in the 2021 incident
  2. Consent decree requires a comprehensive security program
  3. FCC consent decree over the 2021, 2022 and 2023 breaches: 15.75 million USD civil penalty plus 15.75 million USD of cybersecurity spending over two years
  4. Final approval of the class settlement covering about 76 million U.S. residents
  5. Claims for losses and lost timeClosed
11 more
  1. After preliminary approval, the settlement offered up to 25,000 USD for documented losses and lost time, or 25 USD · 100 USD for California residents, plus two years of identity defense services
  2. Agreed to settle the consolidated class action: 350 million USD fund plus 150 million USD of extra security spending in 2022-2023
  3. Long-term partnerships with Mandiant and KPMG as part of a multi-year security investment
  4. The CEO apologised in a letter
  5. Update: phone numbers, IMEI and IMSI also taken; 5.3 million more postpaid accounts and 667,000 former customer accounts
  6. Published a dedicated support page · t-mobile.com/brand/data-breach-2021
  7. Reset the PINs of about 850,000 active prepaid accounts whose PINs were exposed
  8. Offered two years of free identity protection · McAfee ID Theft Protection Service
  9. Statement that unauthorized access to some T-Mobile data occurred
  10. Confirmed the attack and hired a forensic firm; measures to cut off the intruder ran until October 8, 2021
  11. Became aware of a potential attack and opened an internal investigation
Company
T-Mobile
When it happened
Company detected it
Made public
Notice
Leak confirmed
Affected
76,600,000 people · class settlement count, cited by the FCC; 7.8 million current postpaid customers and about 40 million former or prospective customers with SSN

How the facts developed

  1. Phone numbers, IMEI and IMSI also taken; 5.3 million more postpaid accounts and 667,000 former customer accounts
  2. First details: names, birth dates, SSN and driver's licence data of 7.8 million current postpaid customers and about 40 million former or prospective customers; 850,000 prepaid PINs

Sources