ENKR

T-Mobile cyberattack and data theft

Add to my breach check

Made public · 76,600,000 people

What leaked9

Replaceable

  • Mobile account PIN
  • IMSI

Hard to replace

  • Phone IMEI
  • Driver's licence number
  • Mobile number
  • Home or delivery address

Permanent

  • Social Security number
  • Date of birth
  • Full name
  • Mobile account PINaccount PINs of about 850,000 active prepaid customers; T-Mobile reset them
  • Social Security number7.8 million current customers and about 40 million former or prospective customers
  • Driver's licence numberdriver's licence or ID number

To-dos10 · about 2 h in all

  1. Freeze your credit at Equifax, Experian and TransUnionabout 30 minfreeStops: credit in your name (opens in a new tab)
  2. Get an IRS Identity Protection PINabout 20 minStops: tax refund fraud (opens in a new tab)
  3. Turn on instant transaction alertsabout 5 minHelps you notice: bank account fraud, scam calls
  4. Place a fraud alert on your credit reportsabout 10 minfreeLimits harm from: credit in your name (opens in a new tab)
  5. Check your credit reports every week, freeabout 20 minfreeHelps you notice: credit in your name (opens in a new tab)
5 more
  1. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  2. Turn on your carrier's port-out lockabout 5 minLimits harm from: SIM swap
  3. Turn on your carrier's SIM-change lockabout 5 minLimits harm from: SIM swap
  4. Freeze your NCTUE phone and utility fileabout 10 minfreeLimits harm from: phone or utility account (opens in a new tab)
  5. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home

What happened next16 events

  1. UndetectedNone on record
  2. Response 9 eventsNo individual notice on record · show events
  3. Remedy 3 eventsEnded · show events
  4. Penalty 2 eventsFine $15.8M · Back to latest
  5. Disputes 2 eventsSettled · show events

Penalty: 2 events

Back to latest
  1. Consent decree requires a comprehensive security program
  2. FCC consent decree over the 2021, 2022 and 2023 breaches: 15.75 million USD civil penalty plus 15.75 million USD of cybersecurity spending over two years
Company
T-Mobile
When it happened
Company detected it
Made public
Notice
Leak confirmed
Affected
76,600,000 people · class settlement count, cited by the FCC; 7.8 million current postpaid customers and about 40 million former or prospective customers with SSN

How the facts developed

  1. Phone numbers, IMEI and IMSI also taken; 5.3 million more postpaid accounts and 667,000 former customer accounts
  2. First details: names, birth dates, SSN and driver's licence data of 7.8 million current postpaid customers and about 40 million former or prospective customers; 850,000 prepaid PINs

Sources