Hackers Stole Personal Data of 2 Million T-Mobile Customers

On late Thursday, T-Mobile revealed that hackers stole some of the personal data of 2 million people in a new data breach.

In a brief intrusion, hackers stole "some" customer data including names, email addresses, account numbers, and other billing information. The good news is that they did not get credit card numbers, social security numbers, or passwords, according to the company.

In its announcement, T-Mobile said that its cybersecurity team detected an “unauthorized capture of some information” on Monday, Aug. 20.

“Our cyber-security team discovered and shut down an unauthorized access to certain information, including yours, and we promptly reported it to authorities. None of your financial data (including credit card information) or social security numbers were involved, and no passwords were compromised” the announcement published on the company’s website read. “However, you should know that some of your personal information may have been exposed, which may have included one or more of the following: name, billing zip code, phone number, email address, account number and account type (prepaid or postpaid).”

A company spokesperson said that the breach affected “about” or “slightly less than” 3% of its 77 million customers.

“Fortunately not many,” the spokesperson said in a text message, adding she could not disclose the exact number.

The spokesperson added that the “incident” happened “early in the morning on Aug. 20,” when hackers part of “an international group” accessed company servers through an API that “didn’t contain any financial data or other very sensitive data.”

According to the spokesperson, on the same day of the intrusion, the cybersecurity team detected it. “We found it quickly and shut it down very fast,” the spokesperson said.

The spokesperson said she couldn’t give “specifics” of the attack and did not know whether the hackers were criminals or part of a government.

T-Mobile is reaching out to victims directly via text message to notify them, she said.

The company wrote in the announcement that “all affected customers have been, or shortly will be, notified. If you don’t receive a notification than that means your account was not among those impacted by this incident.” T-Mobile also encouraged customers to contact customer service through 611 if they were concerned.

:story: Motherboard