Network Security
Vulnerability Management
Privileged Access Management
Endpoint Security
Threat Hunting
Unified Endpoint Management
Email & Collaboration Security
Contents:
We have lately written about a massive T-Mobile security breach impacting millions of T-Mobile customers. Hackers stole databases containing customer data and tried to sell parts of it on the black market. The company has started an investigation to determine the validity of the claims regarding this topic.
T-mobile has recently confirmed that the numbers of affected customers look like this: prepaid users (850, 000), postpaid clients (approximately 7.8 Million), and roughly 40 million previous or potential customers.
T-Mobile Security Breach: What Data Has Been Stolen and What Data Has Been Not?
T-Mobile reported on their website previously what data has been compromised and what data has been not.
Stolen data includes:
- First and last names of the customers
- Birthdate
- SSN (Social Security Number)
- Driver’s license
This was related to previous postpay clients, current and potential ones.
Importantly, no phone numbers, account numbers, PINs, passwords, or financial information were compromised in any of these files of customers or prospective customers.
Additionally, the company determined that there were also compromised relatively 850,000 names, account PINs, and phone numbers of prepaid clients that were active. Hackers have also taken advantage of prepaid billing documents to gain access to some data related to inactive prepaid accounts.
Security Breaches In a Row
According to the BleepingComputer Publication, T-Mobile has suffered multiple security breaches over time, more specifically: in less than 4 years there were 6 data breaches. The danger of the most recent one is that threat actors could perform SIM swapping attacks that could lead to account takeover of the ones impacted by the cyberattack.
Thus, in 2018, there was reported that cybercriminals gained access to millions of clients’ data, prepaid customer information was afterward exposed in 2019. The March 2020 data breach followed, where threat actors could obtain e-mail accounts of the employees, then in December 2020 proprietary network data was disclosed, and eventually in February 2021 hackers engaged in SIM swamp attacks through a T-Mobile app, impacting this way 400 clients.
Implemented Measures for the Recent T-Mobile Security Breach
As explained in the same post on their website, T-Mobile has taken measures to be a support for its customers.
For the inactive prepaid accounts, the company reset all the PINS to avoid the takeover of the clients’ accounts.
Customers that might be exposed to a threat, are offered via McAfee’s ID Theft Protection Service, free services to secure their identity that has a two years availability.
All postpaid customers should act immediately and modify their PIN. They can do this either online, by logging into their account, or by calling the Customer Care Service (611).
The clients that are eligible should also use Scam Shield to sign up. It’s free and it helps to protect against scams.
Postpaid customers benefit also from Account Takeover Protection features.
The company has also a customer support page where it helps everyone with more details.
Hi! My name is Andra and I am a passionate writer interested in a variety of topics. I am curious about the cybersecurity world and what I want to achieve through what I write is to keep you curious too!
