ENKR

T-Mobile cyberattack and data theft

Add to my breach check

Made public · 76,600,000 people

What leaked9

Replaceable

  • Mobile account PIN
  • IMSI

Hard to replace

  • Phone IMEI
  • Driver's licence number
  • Mobile number
  • Home or delivery address

Permanent

  • Social Security number
  • Date of birth
  • Full name
  • Mobile account PINaccount PINs of about 850,000 active prepaid customers; T-Mobile reset them
  • Social Security number7.8 million current customers and about 40 million former or prospective customers
  • Driver's licence numberdriver's licence or ID number

To-dos10 · about 2 h in all

  1. Freeze your credit at Equifax, Experian and TransUnionabout 30 minfreeStops: credit in your name (opens in a new tab)
  2. Get an IRS Identity Protection PINabout 20 minStops: tax refund fraud (opens in a new tab)
  3. Turn on instant transaction alertsabout 5 minHelps you notice: bank account fraud, scam calls
  4. Place a fraud alert on your credit reportsabout 10 minfreeLimits harm from: credit in your name (opens in a new tab)
  5. Check your credit reports every week, freeabout 20 minfreeHelps you notice: credit in your name (opens in a new tab)
5 more
  1. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  2. Turn on your carrier's port-out lockabout 5 minLimits harm from: SIM swap
  3. Turn on your carrier's SIM-change lockabout 5 minLimits harm from: SIM swap
  4. Freeze your NCTUE phone and utility fileabout 10 minfreeLimits harm from: phone or utility account (opens in a new tab)
  5. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home

What happened next16 events

  1. UndetectedNone on record
  2. Response 9 eventsNo individual notice on record · Back to latest
  3. Remedy 3 eventsEnded · show events
  4. Penalty 2 eventsFine $15.8M · show events
  5. Disputes 2 eventsSettled · show events

Response: 9 events

Back to latest
  1. FCC consent decree: T-Mobile had not identified any fraudulent activity relating to the data taken in the 2021 incident
  2. Long-term partnerships with Mandiant and KPMG as part of a multi-year security investment
  3. The CEO apologised in a letter
  4. Update: phone numbers, IMEI and IMSI also taken; 5.3 million more postpaid accounts and 667,000 former customer accounts
  5. Published a dedicated support page · t-mobile.com/brand/data-breach-2021
4 more
  1. Reset the PINs of about 850,000 active prepaid accounts whose PINs were exposed
  2. Statement that unauthorized access to some T-Mobile data occurred
  3. Confirmed the attack and hired a forensic firm; measures to cut off the intruder ran until October 8, 2021
  4. Became aware of a potential attack and opened an internal investigation
Company
T-Mobile
When it happened
Company detected it
Made public
Notice
Leak confirmed
Affected
76,600,000 people · class settlement count, cited by the FCC; 7.8 million current postpaid customers and about 40 million former or prospective customers with SSN

How the facts developed

  1. Phone numbers, IMEI and IMSI also taken; 5.3 million more postpaid accounts and 667,000 former customer accounts
  2. First details: names, birth dates, SSN and driver's licence data of 7.8 million current postpaid customers and about 40 million former or prospective customers; 850,000 prepaid PINs

Sources