T-Mobile says the hacker obtained data from 37 million customer accounts

[ad_1]

T-Mobile said Thursday that a hacker harvested data, including names, birthdates and phone numbers, from 37 million customer accounts, the company’s second major breach in less than two years.

In a securities filing, T-Mobile said it first discovered a bad actor was getting the data on Jan. 5.

The company said there was no evidence that its systems or network had been compromised, adding that the mechanism exploited by the hacker did not provide access to more sensitive information such as social security numbers, government identification numbers or password or payment card information.

We understand that an incident like this impacts our customers and we regret that this has happened, T-Mobile said in a statement.

The information exposed included names, billing and email addresses, phone numbers, dates of birth, T-Mobile account numbers, and information such as lines on an account and plan features. Many of the accounts didn’t include all that data. The company said it has begun notifying some of the affected customers in accordance with state and federal requirements.

T-Mobile said it is continuing to investigate the exposure and has notified federal authorities. The company said it believes the hacker began recovering the data on Nov. 25 through an application programming interface, a common bit of code that allows software to communicate with other software.

A cyberattack in 2021 exposed data from nearly 77 million T-Mobile customer accounts, including names, Social Security numbers and driver’s license information. As a result, the company agreed to both pay $350 million to settle customer complaints and spend $150 million to improve its cybersecurity practices and technologies.

In Thursday’s filing, T-Mobile said it has made substantial progress to date on those updates. It also acknowledged that it could face significant expenses from the latest breach.

[ad_2]