Trump Mobile Customer Data Leaked in Alleged Supply-Chain Breach A cybercrime group known as BYOD has reportedly leaked personal data belonging to 3,615 Trump Mobile customers, including names, home addresses, phone numbers, email addresses, and order details. The breach was confirmed after Straight Arrow News reviewed the exposed records and contacted affected individuals, who verified the accuracy of their information. Trump Mobile, a branded wireless service operated under Liberty Mobile a Florida-based mobile virtual network operator (MVNO) resells access to another carrier’s network. While the MVNO model is legitimate, the breach highlights vulnerabilities in third-party supply chains. How the Attack Allegedly Unfolded BYOD claims it gained initial access by infecting a Liberty Mobile employee’s device with a remote-access trojan (RAT), allowing attackers to monitor and control the machine. From there, the group says it exploited exposed Trump Mobile subdomains to extract customer records. While these claims remain unverified, the leaked data appears authentic based on independent reviews. The attackers also assert they still have access to a Trump Mobile backend dashboard, providing a screenshot as purported evidence. If true, this breach underscores how device-level compromises can escalate into larger infrastructure breaches. Notable Details and Accountability Gaps Among the leaked records was the information of Eric Brunnett, the Trump Organization’s VP and CIO, responsible for IT and cybersecurity oversight. His inclusion in the dataset raises concerns about the scope of the breach and the adequacy of the response. According to BYOD, when notified of the breach, Trump Mobile allegedly responded: "We have no team to handle this." As of available reports, Trump Mobile has not publicly confirmed the breach, nor is there evidence that affected customers were formally notified, credentials were revoked, or regulators were engaged. Industry-Wide Implications The incident exposes a critical flaw in the MVNO model: while brands outsource network operations, they retain responsibility for customer data. When breaches occur, accountability often falls through gaps in vendor contracts, leaving customers without clear recourse. The case highlights the need for mandatory breach-response obligations across all layers of the supply chain, not just at the carrier level.