T-Mobile said Wednesday that criminals obtained the personal information of nearly 49 million current, former or potential customers in the latest megahack of its servers.
The tour includes customers’ first and last names, date of birth, SSN, and driver’s license / ID information for 7.8 million current postpaid accounts – that is, accounts that are billed at the end of each cycle of billing. Unknown hackers obtained the same data from more than 40 million records belonging to previous or potential customers who had previously applied for credit with T-Mobile.
The names, phone numbers and PINs of the accounts of approximately 850,000 active T-Mobile prepaid customers were also stolen. T-Mobile said “additional information” for an unspecified number of inactive prepaid accounts was also affected.
The cell phone operator said none of the hacked data included customer financial information, credit or debit card information, or other payment information. Except for the data for the 850,000 prepaid accounts, none of the affected data included phone numbers or account PINs.
T-Mobile, which is no stranger to data breaches involving millions of customers, said it has hired cybersecurity experts to assist in an investigation of this latest attack. The company said it has located and closed the access point that the hackers used to breach the servers. The carrier has also coordinated with law enforcement.
In response, T-Mobile said it is:
- Immediately offering 2 years of free identity protection services with McAfee Identity Theft Protection Service.
- Encourage all T-Mobile postpaid customers to proactively change their PIN by logging into their T-Mobile account online or by calling our Customer Care team by dialing 611 on their phone. This precaution is despite the fact that we are not aware that postpaid account PINs have been compromised.
- Offering an extra step to protect your mobile account with our Account Acquisition Protection capabilities for postpaid customers, making it difficult for customer accounts to be fraudulently transferred and stolen.
- Post a single web page later Wednesday for comprehensive information and solutions to help customers take steps to further protect themselves.
News of the breach first emerged over the weekend when someone using the @ und0xxed Twitter account and someone on a cybercrime forum announced the availability of millions of what they claimed were never-before-published records. A. report Motherboard confirmed that the data matched T-Mobile customers. Motherboard said the person who sold the data claimed there were 100 million records available.
It is not known if someone has bought the data or if the data is being used to participate in identity theft or other crimes. It’s not unusual for data stolen in breaches to eventually get published online, so it’s available to anyone who takes the time to find it.
The availability of free credit monitoring is better than nothing, but the most significant steps affected individuals can take are to change account PINs and passwords and implement the aforementioned option of setting a passcode to restrict the transfer of phone numbers to a new account. , a crime commonly known as SIM swapping. Even with such protections, SIM swapping is still a big enough risk that people shouldn’t link important accounts to their phone numbers whenever possible.