T-Mobile
Company Details
Linkedin ID:
t-mobile
Website:
Employees number:
89,361
Number of followers:
621,743
NAICS:
517
Industry Type:
Homepage:
t-mobile.com
IP Addresses:
899
Company ID:
T-M_9421933
Scan Status:
Completed
T-Mobile Company CyberSecurity Posture
t-mobile.com
T-Mobile US, Inc. (NASDAQ: TMUS) is America’s supercharged Un-carrier, delivering an advanced 4G LTE and transformative nationwide 5G network that will offer reliable connectivity for all. T-Mobile’s customers benefit from its unmatched combination of value and quality, unwavering obsession with offering them the best possible service experience and undisputable drive for disruption that creates competition and innovation in wireless and beyond. Based in Bellevue, Wash., T-Mobile provides services through its subsidiaries and operates its flagship brands, T-Mobile and Metro by T-Mobile. For more information, please visit: https://www.t-mobile.com.
T-Mobile A.I CyberSecurity Scoring
T-Mobile Risk Score (AI oriented)Between 550 and 599
T-Mobile
Updated:
- Powered by our proprietary A.I cyber incident model
- Insurance preferes TPRM score to calculate premium
T-Mobile Global Score (TPRM)XXXX
T-Mobile
- Instant access to detailed risk factors
- Benchmark vs. industry & size peers
- Vulnerabilities
- Findings
T-Mobile Company CyberSecurity News & History
Past Incidents
24
Attack Types
4
T-Mobile
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: T-Mobile suffered another breach incident that affected around 37 million customers. The stolen data included addresses, phone numbers, and dates of birth. The carrier has no evidence (at least so far) that any passwords, pins, bank account, credit card information, or Social Security numbers.
T-Mobile
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: T-Mobile USA suffered a data breach incident after its cyber-security team discovered unauthorized access to its customers' data. An attacker exfiltrated personal data such as customer names, billing ZIP codes, phone numbers, email addresses, account numbers, and account types (prepaid or postpaid). However, he did not gain access to passwords, social security numbers, or any financial information. T-mobile notified that 3% of its customers were affected by the attack.
T-Mobile
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: The account information of an undisclosed number of customers of T-mobiles was breached by an unauthorized third-party. The accessed data included name and billing address, phone number, account number, rate plan and features, such as whether you added an international calling feature all related to prepaid service account. T-mobile alerted all impacted customers via SMS notifications and shut down malicious, unauthorized access to some information related to your T-Mobile prepaid wireless account.
T-Mobile
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: T-Mobile suffered a **massive data breach** in August 2023, exposing the personal information of **37 million customers**, including names, billing addresses, emails, phone numbers, dates of birth, and account details. The breach originated from a malicious actor exploiting an API vulnerability, gaining unauthorized access to customer data over a month-long period. While T-Mobile confirmed no financial data (e.g., credit cards, SSNs) or passwords were stolen, the exposed information heightened risks of **phishing, SIM-swapping, and identity fraud**. The incident marked the **ninth major breach** for T-Mobile since 2018, raising concerns over its cybersecurity practices. Regulators and customers criticized the company’s failure to prevent recurring attacks, despite prior settlements and promises to bolster security. The breach’s scale and the sensitivity of leaked data—though not financial—posed **significant reputational damage** and operational disruptions, including customer churn and potential lawsuits.
T-Mobile
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: T-Mobile faced a series of high-profile data breaches dating back to 2021, resulting in the unauthorized exposure of **customers’ personally identifiable information (PII)**, including Social Security numbers, email addresses, and other sensitive data. The breaches violated the FCC’s updated 2024 regulations, which mandate reporting incidents involving **500+ customers’ PII within seven business days**. The company was penalized with a **$31.5 million fine** and forced to overhaul its cybersecurity practices as part of a settlement with the FCC. The breaches compromised **customer trust**, exposed critical personal data to potential misuse (e.g., identity theft, fraud), and highlighted systemic vulnerabilities in T-Mobile’s data protection frameworks. The FCC’s enforcement underscored the severity of failing to safeguard PII, particularly under stricter regulatory scrutiny. The incident aligns with broader industry trends where telecom providers face escalating legal and financial repercussions for inadequate breach responses.
T-Mobile
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: In 2021, T-Mobile suffered a major **data breach** exposing sensitive personal information of millions of customers. The Washington Attorney General opposed T-Mobile’s motion to dismiss legal claims, arguing that the company misled consumers by falsely assuring robust data protection measures while failing to comply with Washington’s **data breach notice law**. The breach compromised customer data, including personally identifiable information (PII), eroding trust and potentially exposing affected individuals to fraud, identity theft, or financial harm. The case highlights T-Mobile’s alleged negligence in safeguarding user data and its inadequate response in notifying impacted parties as required by law. Legal proceedings emphasize the discrepancy between T-Mobile’s public commitments and its actual cybersecurity practices, reinforcing regulatory scrutiny over corporate accountability in data protection.
T-Mobile, USA
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: The Maine Office of the Attorney General reported a data breach involving T-Mobile, USA on April 28, 2023. The breach occurred between February 24, 2023, and March 30, 2023, affecting 836 individuals in total, including one resident in Maine. The breach resulted from external system hacking and involved compromised T-Mobile account PINs and other personal information, including driver's license numbers.
T-Mobile USA, Inc.
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: The California Office of the Attorney General reported a data breach involving T-Mobile US on December 30, 2013. The breach involved unauthorized access to a file stored on servers managed by a T-Mobile supplier, potentially exposing personal information such as names, addresses, Social Security numbers, and/or Driver’s License numbers. The date of the breach discovery was in late November 2013.
T-Mobile USA, Inc.
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: The California Office of the Attorney General reported on August 25, 2021, that T-Mobile USA experienced a data breach on July 22, 2021, involving the unauthorized access of personal customer information. The breach potentially affected data such as names, drivers’ licenses, Social Security numbers, and dates of birth among others, although the specific number of individuals impacted is unknown.
T-Mobile USA
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: The Washington State Office of the Attorney General reported that T-Mobile USA experienced an unauthorized access data breach affecting 772,593 individuals. The breach occurred between November 25, 2022, and January 5, 2023, potentially exposing customer names, full dates of birth, and other account information, but not passwords, payment methods, or Social Security numbers.
T-Mobile USA, Inc.
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: The California Office of the Attorney General reported on October 1, 2015, that T-Mobile USA, Inc. experienced a data breach on September 14, 2015, involving unauthorized access to Experian servers. The breach potentially exposed personal information of customers, including names, addresses, social security numbers, and dates of birth, but no banking or payment information was compromised.
T-Mobile
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: T-mobile company suffered a significant data breach in a cyber attack in December 2021. The customers fell prey to the attacker and suffered SIM swapping attacks and exposed personal information like personal plan information, billing account name, phone and account number, and others. Around 50 million customers' data was compromised in the breach.
T-Mobile
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: T-Mobile suffered a data breach caused after an email vendor was hacked in an incident that exposed the personal and financial information of some of its customers. Some of the compromised email accounts contained T-Mobile customer information such as social security numbers, financial information, government ID numbers, billing information, and rate plans. T-Mobile notified the affected customers affected by sending text messages and identified and shut down a security event involving account information. T-Mobile also offered a free two-year subscription to my true identity online credit monitoring service for those whose financial information was exposed.
T-Mobile
Breach
Rankiteo Explanation
Attack threatening the organization’s existence
Description: T-Mobile, a major telecom service provider with contracts across various divisions of the US Department of Defense, including the Army, Air Force, and Navy, encountered attempts of hacking activity through its routing infrastructure. Although the company has not confirmed that the attack was the Salt Typhoon espionage campaign, it identified and mitigated the intrusion attempts. Despite this, vulnerabilities remain in the telecom infrastructure. Senators are urging the DOD to renegotiate contracts to strengthen cybersecurity defenses, pointing out the risks of surveillance and potential espionage.
T-Mobile
Breach
Rankiteo Explanation
Attack threatening the organization’s existence
Description: In August 2021, T-Mobile experienced a significant cybersecurity breach, resulting in the theft of data from about 50 million existing and potential customers. The information compromised included customer addresses, drivers' licenses, and social security numbers. This breach was orchestrated by a 21-year-old who claimed to have accessed approximately 106GB of T-Mobile's data. The exposure of such sensitive personal information potentially puts millions of individuals at risk of identity theft and fraud, raising serious privacy and security concerns.
T-Mobile
Breach
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Threat actors gained access to the private data of 100 of customers of T-Mobile beginning in late February 2023 as a result of the second data breach of 2023. Only 836 clients, in total, were affected by the security compromise. The company claims that the security breach had no impact on call history or information from personal bank accounts. Depending on the customer, different information was obtained, but it could have included the following: full name, contact information, account number and related phone numbers, T-Mobile account PIN, social security number, government-issued ID, date of birth, balance owing, internal codes used by T-Mobile to service customer accounts (such as rate plan and feature codes), and the number of lines.
T-Mobile
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: In 2023, T-Mobile disclosed its second data breach of the year, affecting 836 customers, following an earlier breach that compromised approximately 37 million customers. T-Mobile, a well-known telecommunications company, faced significant security and privacy scrutiny due to these incidents. The breaches exposed customers' personal data, such as contact information and sensitive account details, putting them at risk of identity theft and fraud. The first breach's extensive impact and the subsequent discovery of another vulnerability reveal challenges in T-Mobile's cybersecurity measures and response strategies. These events highlight the critical importance of robust security protocols and rapid response mechanisms in protecting customer data against the evolving threat landscape in the telecommunications industry.
T-Mobile
Breach
Rankiteo Explanation
Attack threatening the organization's existence
Description: A research team from UC San Diego and the University of Maryland intercepted unencrypted satellite communications, exposing critical vulnerabilities in T-Mobile’s backhaul systems. Over a nine-hour session, they accessed **phone numbers, call logs, and text messages of over 2,700 users** via T-Mobile’s satellite links. While the interception was one-sided (only incoming data to users was exposed, not outgoing), the breach revealed systemic failures in encryption protocols. The researchers used **off-the-shelf equipment costing under $600** to exploit this flaw, demonstrating how easily malicious actors could replicate the attack. T-Mobile was notified and later implemented encryption, but the incident highlights the risks of unsecured satellite-based cellular infrastructure, where **location data, communication metadata, and potentially sensitive user interactions** were left exposed to passive eavesdropping. The breach underscores the broader industry neglect of satellite security, with implications for both consumer privacy and national security, given that military and law enforcement communications were similarly vulnerable in the study.
T-Mobile
Cyber Attack
Rankiteo Explanation
Attack threatening the economy of a geographical region
Description: T-Mobile customers are being targeted by ongoing phishing campaign. The hackers are using malicious links with unblockable texts sent via SMS (Short Message Service) group messages. The attacker are using the data breached form the company in the past. The NJCCIC warned the customers to be alerted of any suspicious activity.
T-Mobile
Cyber Attack
Rankiteo Explanation
Attack threatening the organization’s existence
Description: T-Mobile experienced attempted hacking activities through its routing infrastructure from an unnamed compromised wireline partner. While T-Mobile's security investments, like implementing mandatory two-factor authentication with physical security keys, have significantly enhanced its cybersecurity posture, the underlying vulnerabilities within US telecom systems remain. The incident, linked to the Salt Typhoon espionage campaign, did not result in a breach but highlights the persistent security challenges facing the telecom industry.
T-Mobile
Cyber Attack
Rankiteo Explanation
Attack threatening the organization's existence
Description: T-mobile company suffered a significant data breach in a cyber attack in August 2022. A former owner of a T-Mobile retail store in Eagle Rock was guilty of 14 federal criminal charges related to his $25 million scheme to enrich himself by stealing T-Mobile employee credentials and unlawfully accessing the company's internal computer systems to illicitly "unlock" and "unblock" cellphones. Around 25 million customers' data was compromised in the attack.
T-Mobile
Data Leak
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: A cybercriminal has admitted to hacking businesses like Uber, Sainsbury's, and Groupon to sell customers' personal information on the dark web. The other targets included Nectar, T-Mobile, Asda, Ladbrokes, Coral, and Argos. The data comprised all the information required to complete an online purchase and was then promoted and sold to clients through his dark website. The firm is thought to have lost more than £200,000 due to the theft, although no financial data was collected. West pleaded guilty to two counts of conspiring to defraud, one count of hacking a computer, four counts of possessing and supplying marijuana, two counts of having criminal property, and one crime of money laundering Bitcoins. The leaked data is related to a security breach on a third-party vendor.
T-Mobile
Data Leak
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: T-Mobile experienced its second data breach of 2023; 100 of consumers' personal information was exposed to threat actors. The security incident only affected 836 customers, which is a small number. Personal bank account information and call history, according to the carrier, were unaffected by the security lapse. Each customer's information was collected differently, but it could have included their full name, contact information, account number and related phone numbers, T-Mobile account PIN, social security number, government-issued ID, date of birth, balance due, and internal T-Mobile service account servicer codes, as well as the number of lines. They can get free credit monitoring and identity theft detection services from T-Mobile for two years.
T-Mobile
Vulnerability
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: There was a vulnerability found. T-Mobile classified it as “critical,” patched the bug and gave the researcher a $5,000 reward. Hackers accessed customers’ sensitive information such as email addresses, billing account numbers, and their IMSI, the phone’s standardized unique number that identifies subscribers. They also hijacked their phone numbers and tried stealing money from their banking accounts linked to those numbers.
T-Mobile Company Scoring based on AI Models
Cyber Incidents Likelihood 3 - 6 - 9 months
A.I Risk Score Likelihood 3 - 6 - 9 months
Underwriter Stats for T-Mobile
Incidents vs Telecommunications Industry Average (This Year)
T-Mobile has 69.49% more incidents than the average of same-industry companies with at least one recorded incident.
Incidents vs All-Companies Average (This Year)
T-Mobile has 56.25% more incidents than the average of all companies with at least one recorded incident.
Incident Types T-Mobile vs Telecommunications Industry Avg (This Year)
T-Mobile reported 1 incidents this year: 0 cyber attacks, 0 ransomware, 0 vulnerabilities, 1 data breaches, compared to industry peers with at least 1 incident.
Incident History — T-Mobile (X = Date, Y = Severity)
T-Mobile cyber incidents detection timeline including parent company and subsidiaries
T-Mobile Company Subsidiaries
T-Mobile US, Inc. (NASDAQ: TMUS) is America’s supercharged Un-carrier, delivering an advanced 4G LTE and transformative nationwide 5G network that will offer reliable connectivity for all. T-Mobile’s customers benefit from its unmatched combination of value and quality, unwavering obsession with offering them the best possible service experience and undisputable drive for disruption that creates competition and innovation in wireless and beyond. Based in Bellevue, Wash., T-Mobile provides services through its subsidiaries and operates its flagship brands, T-Mobile and Metro by T-Mobile. For more information, please visit: https://www.t-mobile.com.
Loading...
T-Mobile Similar Companies
Liberty Global
Liberty Global is a world leader in converged broadband, video and mobile communications and an active investor in cutting-edge infrastructure, content and technology ventures. With our investments in fibre-based and 5G networks we play a vital role in society, currently providing over 85 million f
ZTE Corporation
ZTE connects the world with continuous innovation for a better future. The company provides innovative technologies and integrated solutions, and its portfolio spans communication networks, computing infrastructure, industry digital solutions, and personal and home smart terminals. Serving one t
Airtel Africa
Airtel Africa is a leading provider of telecommunications and mobile money services, with a presence in 14 countries in Africa, primarily in East Africa and Central and West Africa. Airtel Africa offers an integrated suite of telecommunications solutions to its subscribers, including mobile voice a
Millicom (NASDAQ U.S.: TIGO, Nasdaq) is a leading provider of fixed and mobile telecommunications services in Latin America. Through our TIGO® and Tigo Business® brands, we provide a wide range of digital services and products, including TIGO Money for mobile financial services, TIGO Sports for loca
Telkomsel
Connecting Nation. Accelerating Indonesia's Future. As Indonesia's leading digital telecommunications company, Telkomsel is committed to building a connected, competitive, and future-ready society. For over 29 years, we've empowered individuals, homes, and businesses with innovative connectivity an
A1 Telekom Austria Group
WE ARE EMPOWERING DIGITAL LIFE We don't know how the world will look like in 2050, but we know that A1 Telekom Austria Group is geared up for current and future demands. We are a leading provider of digital services and communications solutions in Central and Eastern Europe, offering a state-of-th
Welkom bij de LinkedIn pagina van KPN. Sinds jaar en dag maakt KPN technologie toegankelijk. Hier leest u alles over de ontwikkelingen rondom de thema’s die KPN belangrijk vindt, zoals Het Nieuwe Leven & Werken, Veiligheid & Privacy en ICT-infrastructuur. Ook een transparante en betrouwbare dienstve
We believe it’s people who give purpose to our technology. So we’re committed to staying close to our customers and providing them the best experience. And delivering the best tech. On the best network. Because our purpose is to build a connected future so everyone can thrive. We build techno
VEON
VEON is a global digital operator headquartered in Dubai, providing connectivity and digital services across dynamic frontier markets that are home to more than 6% of the world’s population. With our digital operators, we transform lives through technology-driven services that empower millions and
.png)
T-Mobile CyberSecurity News
November 25, 2025 09:07 PM
OPSWAT to show mobile cybersecurity mini lab, media scanning kiosk at Black Hat MEA
Riyadh — OPSWAT, a global leader in IT, OT, and ICS critical infrastructure cybersecurity, will participate in Black Hat Middle East...
November 25, 2025 04:32 PM
Verizon, AT&T, and T‑Mobile users at risk as controversial law protecting them is scrapped
USERS at major communications companies like Verizon and AT&T may be left feeling uneasy as a law protecting cybersecurity has been...
November 25, 2025 02:33 PM
T-Mobile Poland joins cybersecurity programme PWCyber
T-Mobile Poland has joined the Programme for Cooperation on Cybersecurity (PWCyber) initiated by the Polish Ministry of Digitisation to...
November 03, 2025 10:34 AM
Google Declares Android as the Most Secure Mobile OS: A Game Changer in Mobile Cybersecurity
Discover why Google declares Android the most secure mobile OS, marking a true game changer in mobile cybersecurity for users and enterprises alike.
October 31, 2025 07:00 AM
FCC Chair Carr Looks to Eliminate Telecom Cybersecurity Ruling
The decision would strip the government of a tool to push carriers to improve their security in the wake of the Salt Typhoon intrusions.
October 17, 2025 07:00 AM
T-Mobile lifts curtain on new cyber defense center to combat rising security threats
T-Mobile unveils high-tech cybersecurity center to combat rising threats, featuring advanced monitoring and a cyber lab to improve product...
October 16, 2025 07:00 AM
Here’s a peek inside T-Mobile’s new cyber defense, executive briefing centers
T-Mobile just opened a new Cyber Defense Center for real-time threat detection; The Executive Briefing Center next door lets enterprise...
October 16, 2025 07:00 AM
What T-Mobile US (TMUS)'s Cybersecurity Investments and Analyst Upgrade Mean For Shareholders
Aggressive device promotions and new handset launches often drive waves of sign-ups or competitive switches, directly impacting short-term...
September 15, 2025 07:00 AM
What You Need to Know about Digital IDs and Mobile Driver’s Licenses Cybersecurity
The cybersecurity benefits of mDL · Harder to forge: Cryptographic protections make counterfeiting more difficult compared to physical IDs.
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
T-Mobile CyberSecurity History Information
Official Website of T-Mobile
The official website of T-Mobile is https://bit.ly/3IK6i13.
T-Mobile’s AI-Generated Cybersecurity Score
According to Rankiteo, T-Mobile’s AI-generated cybersecurity score is 554, reflecting their Very Poor security posture.
How many security badges does T-Mobile’ have ?
According to Rankiteo, T-Mobile currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
Does T-Mobile have SOC 2 Type 1 certification ?
According to Rankiteo, T-Mobile is not certified under SOC 2 Type 1.
Does T-Mobile have SOC 2 Type 2 certification ?
According to Rankiteo, T-Mobile does not hold a SOC 2 Type 2 certification.
Does T-Mobile comply with GDPR ?
According to Rankiteo, T-Mobile is not listed as GDPR compliant.
Does T-Mobile have PCI DSS certification ?
According to Rankiteo, T-Mobile does not currently maintain PCI DSS compliance.
Does T-Mobile comply with HIPAA ?
According to Rankiteo, T-Mobile is not compliant with HIPAA regulations.
Does T-Mobile have ISO 27001 certification ?
According to Rankiteo,T-Mobile is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Industry Classification of T-Mobile
T-Mobile operates primarily in the Telecommunications industry.
Number of Employees at T-Mobile
T-Mobile employs approximately 89,361 people worldwide.
Subsidiaries Owned by T-Mobile
T-Mobile presently has no subsidiaries across any sectors.
T-Mobile’s LinkedIn Followers
T-Mobile’s official LinkedIn profile has approximately 621,743 followers.
NAICS Classification of T-Mobile
T-Mobile is classified under the NAICS code 517, which corresponds to Telecommunications.
T-Mobile’s Presence on Crunchbase
No, T-Mobile does not have a profile on Crunchbase.
T-Mobile’s Presence on LinkedIn
Yes, T-Mobile maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/t-mobile.
Cybersecurity Incidents Involving T-Mobile
As of November 27, 2025, Rankiteo reports that T-Mobile has experienced 24 cybersecurity incidents.
Number of Peer and Competitor Companies
T-Mobile has an estimated 9,532 peer or competitor companies worldwide.
What types of cybersecurity incidents have occurred at T-Mobile ?
Incident Types: The types of cybersecurity incidents that have occurred include Vulnerability, Data Leak, Breach and Cyber Attack.
What was the total financial impact of these incidents on T-Mobile ?
Total Financial Loss: The total financial loss from these incidents is estimated to be $200 thousand.
How does T-Mobile detect and respond to cybersecurity incidents ?
Detection and Response: The company detects and responds to cybersecurity incidents through an containment measures with shut down malicious, unauthorized access, and communication strategy with alerted impacted customers via sms notifications, and containment measures with identified and shut down a security event involving account information, and communication strategy with notified affected customers by sending text messages, and and containment measures with identified and mitigated intrusion attempts, and third party assistance with legal representation for industry groups (petitioners), and communication strategy with fcc public statements, communication strategy with court opinion publication, and enhanced monitoring with mandated for telecom companies under new rules, and incident response plan activated with partial (by some affected entities post-notification), and third party assistance with academic researchers (uc san diego, university of maryland), and containment measures with encryption implemented by t-mobile, walmart, kpu post-disclosure, and remediation measures with notification to affected entities, remediation measures with public disclosure to raise awareness, and communication strategy with media interviews (wired), communication strategy with academic paper publication..
Incident Details
Can you provide details on each incident ?
Title: T-Mobile Data Breach
Description: T-Mobile company suffered a significant data breach in a cyber attack in December 2021. The customers fell prey to the attacker and suffered SIM swapping attacks and exposed personal information like personal plan information, billing account name, phone and account number, and others. Around 50 million customers' data was compromised in the breach.
Date Detected: 2021-12-01
Type: Data Breach
Attack Vector: SIM Swapping
Title: Ongoing Phishing Campaign Targeting T-Mobile Customers
Description: T-Mobile customers are being targeted by an ongoing phishing campaign. The hackers are using malicious links with unblockable texts sent via SMS group messages. The attackers are using data breached from the company in the past. The NJCCIC warned customers to be alerted of any suspicious activity.
Type: Phishing Campaign
Attack Vector: SMS Phishing
Vulnerability Exploited: Past Data Breach
Motivation: Data Theft
Title: T-Mobile Data Breach and Account Hijacking
Description: A critical vulnerability was exploited to access sensitive customer information and hijack phone numbers, leading to attempted theft from linked banking accounts.
Type: Data Breach, Account Hijacking
Attack Vector: Exploitation of Vulnerability
Vulnerability Exploited: Critical vulnerability
Threat Actor: Hackers
Motivation: Financial Gain
Title: T-Mobile Prepaid Account Data Breach
Description: The account information of an undisclosed number of customers of T-Mobile was breached by an unauthorized third-party. The accessed data included name and billing address, phone number, account number, rate plan and features, such as whether you added an international calling feature all related to prepaid service account. T-Mobile alerted all impacted customers via SMS notifications and shut down malicious, unauthorized access to some information related to your T-Mobile prepaid wireless account.
Type: Data Breach
Attack Vector: Unauthorized Access
Threat Actor: Unauthorized Third-Party
Title: T-Mobile USA Data Breach
Description: T-Mobile USA suffered a data breach incident after its cyber-security team discovered unauthorized access to its customers' data. An attacker exfiltrated personal data such as customer names, billing ZIP codes, phone numbers, email addresses, account numbers, and account types (prepaid or postpaid). However, he did not gain access to passwords, social security numbers, or any financial information. T-mobile notified that 3% of its customers were affected by the attack.
Type: Data Breach
Title: T-Mobile Data Breach via Email Vendor Hack
Description: T-Mobile suffered a data breach caused after an email vendor was hacked in an incident that exposed the personal and financial information of some of its customers.
Type: Data Breach
Attack Vector: Email Vendor Hack
Title: T-Mobile Data Breach
Description: T-Mobile company suffered a significant data breach in a cyber attack in August 2022. A former owner of a T-Mobile retail store in Eagle Rock was guilty of 14 federal criminal charges related to his $25 million scheme to enrich himself by stealing T-Mobile employee credentials and unlawfully accessing the company's internal computer systems to illicitly 'unlock' and 'unblock' cellphones. Around 25 million customers' data was compromised in the attack.
Date Detected: August 2022
Type: Data Breach
Attack Vector: Credential Theft
Vulnerability Exploited: Stolen Employee Credentials
Threat Actor: Former owner of a T-Mobile retail store
Motivation: Financial Gain
Title: T-Mobile Data Breach
Description: T-Mobile suffered a data breach that affected around 37 million customers. The stolen data included addresses, phone numbers, and dates of birth. The carrier has no evidence (at least so far) that any passwords, pins, bank account, credit card information, or Social Security numbers were compromised.
Type: Data Breach
Title: Cybercriminal Hacks Multiple Businesses to Sell Customer Data on Dark Web
Description: A cybercriminal admitted to hacking businesses like Uber, Sainsbury's, and Groupon to sell customers' personal information on the dark web. Other targets included Nectar, T-Mobile, Asda, Ladbrokes, Coral, and Argos. The data comprised all the information required to complete an online purchase and was then promoted and sold to clients through his dark website. The firm is thought to have lost more than £200,000 due to the theft, although no financial data was collected. West pleaded guilty to multiple counts of conspiring to defraud, hacking a computer, possessing and supplying marijuana, having criminal property, and money laundering Bitcoins. The leaked data is related to a security breach on a third-party vendor.
Type: Data Breach
Attack Vector: Hacking
Vulnerability Exploited: Security breach on a third-party vendor
Threat Actor: Cybercriminal
Motivation: Financial Gain
Title: T-Mobile Data Breach
Description: Threat actors gained access to the private data of 100 customers of T-Mobile beginning in late February 2023 as a result of the second data breach of 2023. Only 836 clients, in total, were affected by the security compromise. The company claims that the security breach had no impact on call history or information from personal bank accounts. Depending on the customer, different information was obtained, but it could have included the following: full name, contact information, account number and related phone numbers, T-Mobile account PIN, social security number, government-issued ID, date of birth, balance owing, internal codes used by T-Mobile to service customer accounts (such as rate plan and feature codes), and the number of lines.
Date Detected: late February 2023
Type: Data Breach
Title: T-Mobile Data Breach of 2023
Description: T-Mobile experienced its second data breach of 2023; 100 of consumers' personal information was exposed to threat actors. The security incident only affected 836 customers, which is a small number. Personal bank account information and call history, according to the carrier, were unaffected by the security lapse. Each customer's information was collected differently, but it could have included their full name, contact information, account number and related phone numbers, T-Mobile account PIN, social security number, government-issued ID, date of birth, balance due, and internal T-Mobile service account servicer codes, as well as the number of lines. They can get free credit monitoring and identity theft detection services from T-Mobile for two years.
Type: Data Breach
Title: T-Mobile Data Breaches of 2023
Description: In 2023, T-Mobile disclosed its second data breach of the year, affecting 836 customers, following an earlier breach that compromised approximately 37 million customers. T-Mobile, a well-known telecommunications company, faced significant security and privacy scrutiny due to these incidents. The breaches exposed customers' personal data, such as contact information and sensitive account details, putting them at risk of identity theft and fraud. The first breach's extensive impact and the subsequent discovery of another vulnerability reveal challenges in T-Mobile's cybersecurity measures and response strategies. These events highlight the critical importance of robust security protocols and rapid response mechanisms in protecting customer data against the evolving threat landscape in the telecommunications industry.
Date Publicly Disclosed: 2023
Type: Data Breach
Title: T-Mobile Data Breach
Description: In August 2021, T-Mobile experienced a significant cybersecurity breach, resulting in the theft of data from about 50 million existing and potential customers. The information compromised included customer addresses, drivers' licenses, and social security numbers. This breach was orchestrated by a 21-year-old who claimed to have accessed approximately 106GB of T-Mobile's data. The exposure of such sensitive personal information potentially puts millions of individuals at risk of identity theft and fraud, raising serious privacy and security concerns.
Date Detected: August 2021
Type: Data Breach
Threat Actor: 21-year-old individual
Title: Hacking Attempt on T-Mobile's Routing Infrastructure
Description: T-Mobile, a major telecom service provider with contracts across various divisions of the US Department of Defense, including the Army, Air Force, and Navy, encountered attempts of hacking activity through its routing infrastructure. Although the company has not confirmed that the attack was the Salt Typhoon espionage campaign, it identified and mitigated the intrusion attempts. Despite this, vulnerabilities remain in the telecom infrastructure. Senators are urging the DOD to renegotiate contracts to strengthen cybersecurity defenses, pointing out the risks of surveillance and potential espionage.
Type: Hacking Attempt
Attack Vector: Routing Infrastructure
Motivation: SurveillanceEspionage
Title: T-Mobile Attempted Hacking
Description: T-Mobile experienced attempted hacking activities through its routing infrastructure from an unnamed compromised wireline partner. While T-Mobile's security investments, like implementing mandatory two-factor authentication with physical security keys, have significantly enhanced its cybersecurity posture, the underlying vulnerabilities within US telecom systems remain. The incident, linked to the Salt Typhoon espionage campaign, did not result in a breach but highlights the persistent security challenges facing the telecom industry.
Type: Attempted Hacking
Attack Vector: Routing Infrastructure
Threat Actor: Salt Typhoon espionage campaign
Motivation: Espionage
Title: T-Mobile US Data Breach
Description: Unauthorized access to a file stored on servers managed by a T-Mobile supplier, potentially exposing personal information such as names, addresses, Social Security numbers, and/or Driver’s License numbers.
Date Detected: Late November 2013
Date Publicly Disclosed: December 30, 2013
Type: Data Breach
Title: T-Mobile Data Breach
Description: The Maine Office of the Attorney General reported a data breach involving T-Mobile, USA on April 28, 2023. The breach occurred between February 24, 2023, and March 30, 2023, affecting 836 individuals in total, including one resident in Maine. The breach resulted from external system hacking and involved compromised T-Mobile account PINs and other personal information, including driver's license numbers.
Date Detected: 2023-04-28
Date Publicly Disclosed: 2023-04-28
Type: Data Breach
Attack Vector: External System Hacking
Title: T-Mobile USA Data Breach
Description: Unauthorized access to Experian servers potentially exposed personal information of T-Mobile USA customers.
Date Detected: 2015-09-14
Date Publicly Disclosed: 2015-10-01
Type: Data Breach
Attack Vector: Unauthorized Access
Title: T-Mobile USA Data Breach
Description: Unauthorized access data breach affecting 772,593 individuals, exposing customer names, full dates of birth, and other account information.
Date Detected: 2023-01-05
Type: Data Breach
Attack Vector: Unauthorized Access
Title: T-Mobile USA Data Breach
Description: The California Office of the Attorney General reported on August 25, 2021, that T-Mobile USA experienced a data breach on July 22, 2021, involving the unauthorized access of personal customer information. The breach potentially affected data such as names, drivers’ licenses, Social Security numbers, and dates of birth among others, although specific number of individuals impacted is unknown.
Date Detected: 2021-07-22
Date Publicly Disclosed: 2021-08-25
Type: Data Breach
Title: FCC Upholds New Data Breach Reporting Rules for Telecom Companies After Court Challenge
Description: A federal appeals court panel (2-1 vote) rejected a petition from telecom industry groups challenging the FCC's 2024 data breach reporting rules. The regulations, updated for the first time in 16 years, now require telecom companies to report breaches involving 500+ customers' PII (including SSNs, email addresses) within 7 business days. The court ruled the FCC had statutory authority and that the rules did not violate the Congressional Review Act. The decision follows high-profile breaches at T-Mobile ($31.5M settlement), AT&T ($13.3M), and TracFone ($16M) due to inadequate cybersecurity practices.
Date Publicly Disclosed: 2024-05-29
Type: Regulatory Update
Motivation: Industry Pushback Against RegulationCompliance Cost Concerns
Title: T-Mobile 2021 Data Breach Regulatory Dispute
Description: The Washington Attorney General opposed T-Mobile’s motion to dismiss claims in a case over a data breach it suffered in 2021. The dispute centers on T-Mobile’s alleged failure to implement verifiable commitments to protect user data and non-compliance with Washington’s data breach notice law. The Attorney General argued that T-Mobile’s assurances were misleading and did not align with actual practices, particularly regarding consumer notifications and data protection measures.
Date Publicly Disclosed: 2021
Type: Data Breach
Title: Unencrypted Satellite Communications Interception by Academic Researchers
Description: A team of researchers from UC San Diego and the University of Maryland intercepted unencrypted satellite communications over three years using off-the-shelf equipment. The intercepted data included T-Mobile cellular network calls/texts, in-flight Wi-Fi, utility infrastructure communications (oil rigs, electricity providers), and sensitive military/law enforcement transmissions (locations, mission details, asset tracking). The study revealed widespread lack of encryption in satellite communications, exposing critical infrastructure and personal data to passive interception.
Type: Data Interception
Attack Vector: Passive EavesdroppingUnencrypted Satellite TransmissionsLack of Signal Encryption
Vulnerability Exploited: Unencrypted Satellite BackhaulLack of Signal AuthenticationOver-the-Air Broadcast Without Protection
Threat Actor: Academic Researchers (UC San Diego, University of Maryland)Potential State-Sponsored Actors (hypothetical)Potential Criminal Groups (hypothetical)
Motivation: Academic ResearchSecurity AwarenessVulnerability Disclosure
What are the most common types of attacks the company has faced ?
Common Attack Types: The most common types of attacks the company has faced is Breach.
How does the company identify the attack vectors used in incidents ?
Identification of Attack Vectors: The company identifies the attack vectors used in incidents through SMS Phishing, Email Vendor, Stolen Employee Credentials and Routing Infrastructure.
Impact of the Incidents
What was the impact of each incident ?
Incident : Data Breach TMO154319322
Data Compromised: Personal plan information, Billing account name, Phone and account number
Incident : Data Breach, Account Hijacking TMO18348622
Data Compromised: Email addresses, Billing account numbers, Imsi
Incident : Data Breach TMO0241722
Data Compromised: Name, Billing address, Phone number, Account number, Rate plan and features
Incident : Data Breach TMO15303722
Data Compromised: Customer names, Billing zip codes, Phone numbers, Email addresses, Account numbers, Account types
Incident : Data Breach TMO15334722
Data Compromised: Social security numbers, Financial information, Government id numbers, Billing information, Rate plans
Incident : Data Breach TMO1148161122
Data Compromised: Customer data
Systems Affected: Internal computer systems
Legal Liabilities: 14 federal criminal charges
Incident : Data Breach TMO215721123
Data Compromised: Addresses, Phone numbers, Dates of birth
Incident : Data Breach TMO20024323
Financial Loss: More than £200,000
Data Compromised: Customers' personal information
Incident : Data Breach TMO05529523
Data Compromised: Full name, Contact information, Account number and related phone numbers, T-mobile account pin, Social security number, Government-issued id, Date of birth, Balance owing, Internal codes used by t-mobile to service customer accounts, Number of lines
Incident : Data Breach TMO11721023
Data Compromised: Full name, Contact information, Account number and related phone numbers, T-mobile account pin, Social security number, Government-issued id, Date of birth, Balance due, Internal t-mobile service account servicer codes, Number of lines
Incident : Data Breach T-M811050624
Data Compromised: Contact information, Sensitive account details
Brand Reputation Impact: significant security and privacy scrutiny
Identity Theft Risk: high
Incident : Data Breach T-M416050724
Data Compromised: Customer addresses, Drivers' licenses, Social security numbers
Identity Theft Risk: High
Incident : Hacking Attempt T-M000120524
Systems Affected: Routing Infrastructure
Incident : Data Breach T-M416072525
Data Compromised: Names, Addresses, Social security numbers, Driver’s license numbers
Incident : Data Breach T-M835072625
Data Compromised: T-mobile account pins, Driver's license numbers
Incident : Data Breach T-M759072725
Data Compromised: Names, Addresses, Social security numbers, Dates of birth
Incident : Data Breach T-M510072825
Data Compromised: Customer names, Full dates of birth, Other account information
Incident : Data Breach T-M228072925
Data Compromised: Names, Drivers’ licenses, Social security numbers, Dates of birth
Incident : Regulatory Update T-M733081425
Operational Impact: Increased Compliance Burden for Telecom CompaniesMandatory 7-Day Breach Reporting for PII (500+ customers)
Brand Reputation Impact: Potential Trust Erosion Due to Mandatory DisclosuresEnhanced Transparency for Customers
Legal Liabilities: FCC Fines for Non-Compliance (e.g., T-Mobile: $31.5M, AT&T: $13.3M, TracFone: $16M)
Identity Theft Risk: ['Expanded Reporting for SSNs, Email Addresses (Previously Limited to CPNI like Call Records)']
Incident : Data Breach T-M2402224101125
Identity Theft Risk: True
Incident : Data Interception T-M5362753101525
Data Compromised: T-mobile user call/text metadata (2,700+ users), In-flight wi-fi communications, Utility infrastructure comms (oil rigs, electricity providers), Us military sea vessel names/locations, Mexican military/law enforcement intelligence (narcotics tracking, asset maintenance, mission details), Military/law enforcement personnel/equipment/facility locations
Systems Affected: T-Mobile satellite backhaulIn-flight Wi-Fi systemsUtility infrastructure satellite comms (oil rigs, electricity providers)US military sea vessel communicationsMexican military/law enforcement satellite networks
Operational Impact: Exposure of sensitive military/law enforcement operationsRisk to critical infrastructure (oil rigs, electricity grids)Potential compromise of personnel safety
Brand Reputation Impact: Potential erosion of trust in satellite communication providersNegative publicity for T-Mobile, affected utilities, and military agencies
Legal Liabilities: Potential wiretapping violations (investigated but not prosecuted)Regulatory scrutiny for affected entities
Identity Theft Risk: ['Low (metadata-only for T-Mobile users)', 'High for military/law enforcement personnel (location/mission details exposed)']
What is the average financial loss per incident ?
Average Financial Loss: The average financial loss per incident is $8.33 thousand.
What types of data are most commonly compromised in incidents ?
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Personal Plan Information, Billing Account Name, Phone And Account Number, , Email Addresses, Billing Account Numbers, Imsi, , Personally Identifiable Information, Account Information, , Customer Names, Billing Zip Codes, Phone Numbers, Email Addresses, Account Numbers, Account Types, , Social Security Numbers, Financial Information, Government Id Numbers, Billing Information, Rate Plans, , Customer data, Addresses, Phone Numbers, Dates Of Birth, , Personal information required to complete an online purchase, Full Name, Contact Information, Account Number And Related Phone Numbers, T-Mobile Account Pin, Social Security Number, Government-Issued Id, Date Of Birth, Balance Owing, Internal Codes Used By T-Mobile To Service Customer Accounts, Number Of Lines, , Personal Information, , Contact Information, Sensitive Account Details, , Customer Addresses, Drivers' Licenses, Social Security Numbers, , Names, Addresses, Social Security Numbers, Driver’S License Numbers, , T-Mobile Account Pins, Driver'S License Numbers, , Personal Information, , Customer Names, Full Dates Of Birth, Other Account Information, , Names, Drivers’ Licenses, Social Security Numbers, Dates Of Birth, , Customer Proprietary Network Information (Cpni), Personally Identifiable Information (Pii): Ssns, Email Addresses, , Sensitive Personal Information, , Call/Text Metadata (Phone Numbers, Timestamps), Military/Law Enforcement Operational Data (Locations, Mission Details), Utility Infrastructure Communications, Vessel/Asset Maintenance Records and .
Which entities were affected by each incident ?
Incident : Data Breach TMO154319322
Entity Name: T-Mobile
Entity Type: Telecommunications
Industry: Telecommunications
Customers Affected: 50 million
Incident : Phishing Campaign TMO102316422
Entity Name: T-Mobile
Entity Type: Telecommunications Company
Industry: Telecommunications
Incident : Data Breach, Account Hijacking TMO18348622
Entity Name: T-Mobile
Entity Type: Telecommunications Company
Industry: Telecommunications
Incident : Data Breach TMO0241722
Entity Name: T-Mobile
Entity Type: Telecommunications Company
Industry: Telecommunications
Incident : Data Breach TMO15303722
Entity Name: T-Mobile USA
Entity Type: Telecommunications Company
Industry: Telecommunications
Location: United States
Customers Affected: 3%
Incident : Data Breach TMO15334722
Entity Name: T-Mobile
Entity Type: Telecommunications Company
Industry: Telecommunications
Incident : Data Breach TMO1148161122
Entity Name: T-Mobile
Entity Type: Telecommunications Company
Industry: Telecommunications
Location: Eagle Rock
Customers Affected: 25 million
Incident : Data Breach TMO215721123
Entity Name: T-Mobile
Entity Type: Telecommunications
Industry: Telecommunications
Customers Affected: 37 million
Incident : Data Breach TMO20024323
Entity Name: T-Mobile
Entity Type: Business
Industry: Telecommunications
Incident : Data Breach TMO05529523
Entity Name: T-Mobile
Entity Type: Telecommunications Company
Industry: Telecommunications
Customers Affected: 836
Incident : Data Breach TMO11721023
Entity Name: T-Mobile
Entity Type: Company
Industry: Telecommunications
Customers Affected: 836
Incident : Data Breach T-M811050624
Entity Name: T-Mobile
Entity Type: Telecommunications Company
Industry: Telecommunications
Customers Affected: 836, 37 million
Incident : Data Breach T-M416050724
Entity Name: T-Mobile
Entity Type: Telecommunications Company
Industry: Telecommunications
Customers Affected: 50 million
Incident : Hacking Attempt T-M000120524
Entity Name: T-Mobile
Entity Type: Telecom Service Provider
Industry: Telecommunications
Location: United States
Incident : Attempted Hacking T-M000121124
Entity Name: T-Mobile
Entity Type: Telecommunications Company
Industry: Telecom
Location: USA
Incident : Data Breach T-M416072525
Entity Name: T-Mobile US
Entity Type: Telecommunications Company
Industry: Telecommunications
Location: United States
Incident : Data Breach T-M835072625
Entity Name: T-Mobile
Entity Type: Telecommunications Company
Industry: Telecommunications
Location: USA
Customers Affected: 836
Incident : Data Breach T-M759072725
Entity Name: T-Mobile USA, Inc.
Entity Type: Company
Industry: Telecommunications
Location: United States
Incident : Data Breach T-M510072825
Entity Name: T-Mobile USA
Entity Type: Telecommunications Company
Industry: Telecommunications
Location: United States
Customers Affected: 772593
Incident : Data Breach T-M228072925
Entity Name: T-Mobile USA
Entity Type: Telecommunications Company
Industry: Telecommunications
Location: United States
Incident : Regulatory Update T-M733081425
Entity Name: Telecommunications Industry (Broad Impact)
Entity Type: Industry Sector
Industry: Telecommunications
Location: United States
Incident : Regulatory Update T-M733081425
Entity Name: T-Mobile
Entity Type: Telecom Carrier
Industry: Telecommunications
Location: United States
Size: Large
Incident : Regulatory Update T-M733081425
Entity Name: AT&T
Entity Type: Telecom Carrier
Industry: Telecommunications
Location: United States
Size: Large
Incident : Regulatory Update T-M733081425
Entity Name: TracFone (Verizon-owned)
Entity Type: Prepaid Wireless Provider
Industry: Telecommunications
Location: United States
Size: Large
Incident : Data Breach T-M2402224101125
Entity Name: T-Mobile
Entity Type: Corporation
Industry: Telecommunications
Location: United States
Size: Large
Incident : Data Interception T-M5362753101525
Entity Name: T-Mobile
Entity Type: Telecommunications Provider
Industry: Telecommunications
Location: USA
Size: Large (Fortune 500)
Customers Affected: 2,700+ (metadata exposure)
Incident : Data Interception T-M5362753101525
Entity Name: Unnamed Utility Companies (Oil Rigs, Electricity Providers)
Entity Type: Critical Infrastructure
Industry: Energy/Utilities
Location: USAGlobal (via satellite)
Incident : Data Interception T-M5362753101525
Entity Name: US Military (Sea Vessels)
Entity Type: Government/Defense
Industry: Defense
Location: Global
Incident : Data Interception T-M5362753101525
Entity Name: Mexican Military/Law Enforcement
Entity Type: Government/Defense
Industry: Defense/Law Enforcement
Location: Mexico
Incident : Data Interception T-M5362753101525
Entity Name: Walmart (mentioned as remediated)
Entity Type: Retail
Industry: Retail
Location: USA
Size: Large (Fortune 1)
Incident : Data Interception T-M5362753101525
Entity Name: KPU (mentioned as remediated)
Response to the Incidents
What measures were taken in response to each incident ?
Incident : Data Breach TMO0241722
Containment Measures: Shut down malicious, unauthorized access
Communication Strategy: Alerted impacted customers via SMS notifications
Incident : Data Breach TMO15334722
Containment Measures: Identified and shut down a security event involving account information
Communication Strategy: Notified affected customers by sending text messages
Incident : Data Breach TMO1148161122
Incident : Hacking Attempt T-M000120524
Containment Measures: Identified and mitigated intrusion attempts
Incident : Regulatory Update T-M733081425
Third Party Assistance: Legal Representation For Industry Groups (Petitioners).
Communication Strategy: FCC Public StatementsCourt Opinion Publication
Enhanced Monitoring: Mandated for Telecom Companies Under New Rules
Incident : Data Interception T-M5362753101525
Incident Response Plan Activated: ['Partial (by some affected entities post-notification)']
Third Party Assistance: Academic Researchers (Uc San Diego, University Of Maryland).
Containment Measures: Encryption implemented by T-Mobile, Walmart, KPU post-disclosure
Remediation Measures: Notification to affected entitiesPublic disclosure to raise awareness
Communication Strategy: Media interviews (Wired)Academic paper publication
What is the company's incident response plan?
Incident Response Plan: The company's incident response plan is described as Partial (by some affected entities post-notification), .
How does the company involve third-party assistance in incident response ?
Third-Party Assistance: The company involves third-party assistance in incident response through Legal Representation for Industry Groups (Petitioners), , Academic researchers (UC San Diego, University of Maryland), .
Data Breach Information
What type of data was compromised in each breach ?
Incident : Data Breach TMO154319322
Type of Data Compromised: Personal plan information, Billing account name, Phone and account number
Number of Records Exposed: 50 million
Incident : Data Breach, Account Hijacking TMO18348622
Type of Data Compromised: Email addresses, Billing account numbers, Imsi
Sensitivity of Data: High
Incident : Data Breach TMO0241722
Type of Data Compromised: Personally identifiable information, Account information
Personally Identifiable Information: NameBilling AddressPhone Number
Incident : Data Breach TMO15303722
Type of Data Compromised: Customer names, Billing zip codes, Phone numbers, Email addresses, Account numbers, Account types
Incident : Data Breach TMO15334722
Type of Data Compromised: Social security numbers, Financial information, Government id numbers, Billing information, Rate plans
Sensitivity of Data: High
Personally Identifiable Information: social security numbersgovernment ID numbers
Incident : Data Breach TMO1148161122
Type of Data Compromised: Customer data
Number of Records Exposed: 25 million
Incident : Data Breach TMO215721123
Type of Data Compromised: Addresses, Phone numbers, Dates of birth
Number of Records Exposed: 37 million
Personally Identifiable Information: addressesphone numbersdates of birth
Incident : Data Breach TMO20024323
Type of Data Compromised: Personal information required to complete an online purchase
Incident : Data Breach TMO05529523
Type of Data Compromised: Full name, Contact information, Account number and related phone numbers, T-mobile account pin, Social security number, Government-issued id, Date of birth, Balance owing, Internal codes used by t-mobile to service customer accounts, Number of lines
Number of Records Exposed: 836
Incident : Data Breach TMO11721023
Type of Data Compromised: Personal information
Number of Records Exposed: 836
Sensitivity of Data: high
Personally Identifiable Information: full namecontact informationsocial security numbergovernment-issued IDdate of birth
Incident : Data Breach T-M811050624
Type of Data Compromised: Contact information, Sensitive account details
Number of Records Exposed: 836, 37 million
Sensitivity of Data: high
Personally Identifiable Information: yes
Incident : Data Breach T-M416050724
Type of Data Compromised: Customer addresses, Drivers' licenses, Social security numbers
Number of Records Exposed: 50 million
Sensitivity of Data: High
Data Exfiltration: 106GB
Personally Identifiable Information: Yes
Incident : Data Breach T-M416072525
Type of Data Compromised: Names, Addresses, Social security numbers, Driver’s license numbers
Incident : Data Breach T-M835072625
Type of Data Compromised: T-mobile account pins, Driver's license numbers
Number of Records Exposed: 836
Incident : Data Breach T-M759072725
Type of Data Compromised: Personal information
Sensitivity of Data: High
Personally Identifiable Information: NamesAddressesSocial Security NumbersDates of Birth
Incident : Data Breach T-M510072825
Type of Data Compromised: Customer names, Full dates of birth, Other account information
Number of Records Exposed: 772593
Incident : Data Breach T-M228072925
Type of Data Compromised: Names, Drivers’ licenses, Social security numbers, Dates of birth
Sensitivity of Data: High
Incident : Regulatory Update T-M733081425
Type of Data Compromised: Customer proprietary network information (cpni), Personally identifiable information (pii): ssns, email addresses
Number of Records Exposed: Threshold: 500+ Customers (Reporting Requirement)
Sensitivity of Data: High (SSNs, PII)
Personally Identifiable Information: Social Security NumbersEmail AddressesCall RecordsBilling Information
Incident : Data Breach T-M2402224101125
Type of Data Compromised: Sensitive personal information
Sensitivity of Data: High
Incident : Data Interception T-M5362753101525
Type of Data Compromised: Call/text metadata (phone numbers, timestamps), Military/law enforcement operational data (locations, mission details), Utility infrastructure communications, Vessel/asset maintenance records
Number of Records Exposed: 2,700+ (T-Mobile users), Unknown (military/utility data)
Sensitivity of Data: High (military/law enforcement)Medium (utility infrastructure)Low (T-Mobile metadata)
Data Exfiltration: Passive interception (no active exfiltration)
Data Encryption: None (unencrypted transmissions)
File Types Exposed: Voice call metadataText message metadataOperational logsMaintenance recordsLocation data
Personally Identifiable Information: Phone numbers (T-Mobile users)Military/law enforcement personnel locations
What measures does the company take to prevent data exfiltration ?
Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Notification to affected entities, Public disclosure to raise awareness, .
How does the company handle incidents involving personally identifiable information (PII) ?
Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by shut down malicious, unauthorized access, identified and shut down a security event involving account information, identified and mitigated intrusion attempts, encryption implemented by t-mobile, walmart, kpu post-disclosure and .
Regulatory Compliance
Were there any regulatory violations and fines imposed for each incident ?
Incident : Data Breach TMO1148161122
Legal Actions: 14 federal criminal charges
Incident : Regulatory Update T-M733081425
Regulations Violated: Pre-2024 FCC Breach Reporting Rules (Outdated for 16 Years),
Fines Imposed: ['T-Mobile: $31.5M (2021+ Incidents)', 'AT&T: $13.3M (Cloud Vendor Breach)', 'TracFone: $16M (Customer Data Safeguard Failures)']
Legal Actions: Industry Petition to Block 2024 Rules (Rejected 2-1 by Sixth Circuit Court of Appeals), Congressional Review Act Challenge (Dismissed),
Regulatory Notifications: 7-Business-Day Reporting Deadline for Breaches Affecting 500+ Customers
Incident : Data Breach T-M2402224101125
Regulations Violated: Washington Data Breach Notice Law,
Legal Actions: Opposition to T-Mobile’s motion to dismiss claims by Washington Attorney General,
Incident : Data Interception T-M5362753101525
Regulations Violated: Potential violations of wiretapping laws (investigated but not prosecuted), Sector-specific encryption requirements (e.g., defense, telecommunications),
Regulatory Notifications: Informal notifications by researchers to affected entities
How does the company ensure compliance with regulatory requirements ?
Ensuring Regulatory Compliance: The company ensures compliance with regulatory requirements through 14 federal criminal charges, Industry Petition to Block 2024 Rules (Rejected 2-1 by Sixth Circuit Court of Appeals), Congressional Review Act Challenge (Dismissed), , Opposition to T-Mobile’s motion to dismiss claims by Washington Attorney General, .
Lessons Learned and Recommendations
What lessons were learned from each incident ?
Incident : Data Breach T-M811050624
Lessons Learned: The critical importance of robust security protocols and rapid response mechanisms in protecting customer data against the evolving threat landscape in the telecommunications industry.
Incident : Regulatory Update T-M733081425
Lessons Learned: Regulatory Agencies Can Expand Authority to Address Evolving Threats (e.g., PII vs. CPNI), Industry Resistance to Compliance Costs May Fail in Court if Public Interest (e.g., Consumer Protection) is Demonstrated, Proactive Cybersecurity Investments Can Mitigate Fines (e.g., T-Mobile's Overhaul Post-Settlement)
Incident : Data Interception T-M5362753101525
Lessons Learned: Widespread assumption of 'security through obscurity' in satellite communications is flawed., Critical infrastructure and military systems rely on unencrypted satellite links, creating systemic risk., Low-cost equipment can intercept high-value data, lowering the barrier for adversaries., Passive interception of broadcast signals may not violate laws, highlighting gaps in regulatory frameworks.
What recommendations were made to prevent future incidents ?
Incident : Hacking Attempt T-M000120524
Recommendations: Senators are urging the DOD to renegotiate contracts to strengthen cybersecurity defenses
Incident : Regulatory Update T-M733081425
Recommendations: Telecom Companies Should Audit PII Storage/Access to Comply with Expanded Reporting Rules, Implement Automated Breach Detection to Meet 7-Day Deadline, Enhance Third-Party Vendor Security (e.g., AT&T's Cloud Vendor Breach), Monitor Dark Web for Exfiltrated PII to Preempt Regulatory ActionTelecom Companies Should Audit PII Storage/Access to Comply with Expanded Reporting Rules, Implement Automated Breach Detection to Meet 7-Day Deadline, Enhance Third-Party Vendor Security (e.g., AT&T's Cloud Vendor Breach), Monitor Dark Web for Exfiltrated PII to Preempt Regulatory ActionTelecom Companies Should Audit PII Storage/Access to Comply with Expanded Reporting Rules, Implement Automated Breach Detection to Meet 7-Day Deadline, Enhance Third-Party Vendor Security (e.g., AT&T's Cloud Vendor Breach), Monitor Dark Web for Exfiltrated PII to Preempt Regulatory ActionTelecom Companies Should Audit PII Storage/Access to Comply with Expanded Reporting Rules, Implement Automated Breach Detection to Meet 7-Day Deadline, Enhance Third-Party Vendor Security (e.g., AT&T's Cloud Vendor Breach), Monitor Dark Web for Exfiltrated PII to Preempt Regulatory Action
Incident : Data Interception T-M5362753101525
Recommendations: Mandate encryption for all satellite communications, especially for critical infrastructure and defense., Implement signal authentication and access controls for satellite transmissions., Conduct regular audits of satellite security protocols by third-party assessors., Raise awareness among satellite operators about the risks of unencrypted broadcasts., Develop international standards for secure satellite communications.Mandate encryption for all satellite communications, especially for critical infrastructure and defense., Implement signal authentication and access controls for satellite transmissions., Conduct regular audits of satellite security protocols by third-party assessors., Raise awareness among satellite operators about the risks of unencrypted broadcasts., Develop international standards for secure satellite communications.Mandate encryption for all satellite communications, especially for critical infrastructure and defense., Implement signal authentication and access controls for satellite transmissions., Conduct regular audits of satellite security protocols by third-party assessors., Raise awareness among satellite operators about the risks of unencrypted broadcasts., Develop international standards for secure satellite communications.Mandate encryption for all satellite communications, especially for critical infrastructure and defense., Implement signal authentication and access controls for satellite transmissions., Conduct regular audits of satellite security protocols by third-party assessors., Raise awareness among satellite operators about the risks of unencrypted broadcasts., Develop international standards for secure satellite communications.Mandate encryption for all satellite communications, especially for critical infrastructure and defense., Implement signal authentication and access controls for satellite transmissions., Conduct regular audits of satellite security protocols by third-party assessors., Raise awareness among satellite operators about the risks of unencrypted broadcasts., Develop international standards for secure satellite communications.
What are the key lessons learned from past incidents ?
Key Lessons Learned: The key lessons learned from past incidents are The critical importance of robust security protocols and rapid response mechanisms in protecting customer data against the evolving threat landscape in the telecommunications industry.Regulatory Agencies Can Expand Authority to Address Evolving Threats (e.g., PII vs. CPNI),Industry Resistance to Compliance Costs May Fail in Court if Public Interest (e.g., Consumer Protection) is Demonstrated,Proactive Cybersecurity Investments Can Mitigate Fines (e.g., T-Mobile's Overhaul Post-Settlement)Widespread assumption of 'security through obscurity' in satellite communications is flawed.,Critical infrastructure and military systems rely on unencrypted satellite links, creating systemic risk.,Low-cost equipment can intercept high-value data, lowering the barrier for adversaries.,Passive interception of broadcast signals may not violate laws, highlighting gaps in regulatory frameworks.
What recommendations has the company implemented to improve cybersecurity ?
Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Senators are urging the DOD to renegotiate contracts to strengthen cybersecurity defenses.
References
Where can I find more information about each incident ?
Incident : Phishing Campaign TMO102316422
Source: NJCCIC
Incident : Data Breach TMO15334722
Source: T-Mobile
Incident : Data Breach T-M416072525
Source: California Office of the Attorney General
Incident : Data Breach T-M835072625
Source: Maine Office of the Attorney General
Date Accessed: 2023-04-28
Incident : Data Breach T-M759072725
Source: California Office of the Attorney General
Date Accessed: 2015-10-01
Incident : Data Breach T-M510072825
Source: Washington State Office of the Attorney General
Incident : Data Breach T-M228072925
Source: California Office of the Attorney General
Date Accessed: 2021-08-25
Incident : Regulatory Update T-M733081425
Source: U.S. Court of Appeals for the Sixth Circuit Opinion
Date Accessed: 2024-05-29
Incident : Regulatory Update T-M733081425
Source: FCC Press Release on 2024 Data Breach Rules
URL: https://www.fcc.gov/document/fcc-adopts-new-data-breach-reporting-rules
Date Accessed: 2023-12-13
Incident : Regulatory Update T-M733081425
Source: Reuters: 'US court upholds FCC rules requiring telecom firms to report breaches'
Date Accessed: 2024-05-29
Incident : Regulatory Update T-M733081425
Source: FCC Enforcement Bureau Settlements (T-Mobile, AT&T, TracFone)
URL: https://www.fcc.gov/enforcement
Date Accessed: 2024-05-30
Incident : Data Interception T-M5362753101525
Source: Wired Magazine
Incident : Data Interception T-M5362753101525
Source: UC San Diego/University of Maryland Study (PDF)
Where can stakeholders find additional resources on cybersecurity best practices ?
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: NJCCIC, and Source: T-Mobile, and Source: California Office of the Attorney General, and Source: Maine Office of the Attorney GeneralDate Accessed: 2023-04-28, and Source: California Office of the Attorney GeneralDate Accessed: 2015-10-01, and Source: Washington State Office of the Attorney General, and Source: California Office of the Attorney GeneralDate Accessed: 2021-08-25, and Source: U.S. Court of Appeals for the Sixth Circuit OpinionDate Accessed: 2024-05-29, and Source: FCC Press Release on 2024 Data Breach RulesUrl: https://www.fcc.gov/document/fcc-adopts-new-data-breach-reporting-rulesDate Accessed: 2023-12-13, and Source: Reuters: 'US court upholds FCC rules requiring telecom firms to report breaches'Url: https://www.reuters.com/legal/us-court-upholds-fcc-rules-requiring-telecom-firms-report-breaches-2024-05-29/Date Accessed: 2024-05-29, and Source: FCC Enforcement Bureau Settlements (T-Mobile, AT&T, TracFone)Url: https://www.fcc.gov/enforcementDate Accessed: 2024-05-30, and Source: MLexDate Accessed: 2025-10-10, and Source: Wired Magazine, and Source: UC San Diego/University of Maryland Study (PDF).
Investigation Status
What is the current status of the investigation for each incident ?
Incident : Regulatory Update T-M733081425
Investigation Status: Completed (Court Ruling Issued)
Incident : Data Breach T-M2402224101125
Investigation Status: Ongoing (as of October 2025)
Incident : Data Interception T-M5362753101525
Investigation Status: Completed (academic study); partial remediation by notified entities
How does the company communicate the status of incident investigations to stakeholders ?
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Alerted impacted customers via SMS notifications, Notified affected customers by sending text messages, Fcc Public Statements, Court Opinion Publication, Media Interviews (Wired) and Academic Paper Publication.
Stakeholder and Customer Advisories
Were there any advisories issued to stakeholders or customers for each incident ?
Incident : Phishing Campaign TMO102316422
Customer Advisories: NJCCIC warned customers to be alerted of any suspicious activity.
Incident : Data Breach TMO0241722
Customer Advisories: Alerted impacted customers via SMS notifications
Incident : Data Breach TMO15334722
Customer Advisories: Offered a free two-year subscription to my true identity online credit monitoring service for those whose financial information was exposed
Incident : Regulatory Update T-M733081425
Stakeholder Advisories: Telecom Companies Must Update Incident Response Plans To Include 7-Day Pii Breach Reporting, Legal Teams Should Review Congressional Review Act Implications For Future Challenges.
Customer Advisories: Consumers May Receive More Breach Notifications Due to Expanded PII DefinitionFCC Encourages Customers to Monitor Credit Reports for Signs of Identity Theft
Incident : Data Interception T-M5362753101525
Stakeholder Advisories: Researchers Notified Affected Companies/Agencies; Some Implemented Encryption.
What advisories does the company provide to stakeholders and customers following an incident ?
Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were NJCCIC warned customers to be alerted of any suspicious activity., Alerted impacted customers via SMS notifications, Offered a free two-year subscription to my true identity online credit monitoring service for those whose financial information was exposed, Telecom Companies Must Update Incident Response Plans To Include 7-Day Pii Breach Reporting, Legal Teams Should Review Congressional Review Act Implications For Future Challenges, Consumers May Receive More Breach Notifications Due To Expanded Pii Definition, Fcc Encourages Customers To Monitor Credit Reports For Signs Of Identity Theft, and Researchers Notified Affected Companies/Agencies; Some Implemented Encryption.
Initial Access Broker
How did the initial access broker gain entry for each incident ?
Incident : Phishing Campaign TMO102316422
Entry Point: SMS Phishing
Incident : Data Breach TMO15334722
Entry Point: Email Vendor
Incident : Data Breach TMO1148161122
Entry Point: Stolen Employee Credentials
Incident : Attempted Hacking T-M000121124
Entry Point: Routing Infrastructure
Post-Incident Analysis
What were the root causes and corrective actions taken for each incident ?
Incident : Data Breach TMO1148161122
Root Causes: Stolen Employee Credentials
Incident : Regulatory Update T-M733081425
Root Causes: Outdated Regulatory Framework (16 Years Without Updates), Industry Lobbying Against Stricter Oversight, Inadequate Third-Party Risk Management (E.G., At&T'S Cloud Vendor Breach),
Corrective Actions: Fcc'S Rulemodernization To Include Pii (Beyond Cpni), Mandatory Timely Disclosure To Reduce Consumer Harm, Financial Penalties To Incentivize Compliance (E.G., T-Mobile'S $31.5M Settlement),
Incident : Data Breach T-M2402224101125
Root Causes: Alleged Failure To Implement Verifiable Data Protection Commitments, Non-Compliance With Data Breach Notification Laws,
Incident : Data Interception T-M5362753101525
Root Causes: Lack Of Encryption In Satellite Backhaul Systems, Over-Reliance On 'Security Through Obscurity' (Assumption That Signals Wouldn’T Be Intercepted), Absence Of Regulatory Enforcement For Satellite Security Standards, Low Awareness Of Interception Risks Among Satellite Operators,
Corrective Actions: T-Mobile, Walmart, And Kpu Implemented Encryption Post-Disclosure., Public Disclosure To Pressure Other Operators Into Securing Transmissions., Academic Outreach To Satellite Industry Stakeholders.,
What is the company's process for conducting post-incident analysis ?
Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Legal Representation For Industry Groups (Petitioners), , Mandated For Telecom Companies Under New Rules, , Academic Researchers (Uc San Diego, University Of Maryland), .
What corrective actions has the company taken based on post-incident analysis ?
Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Fcc'S Rulemodernization To Include Pii (Beyond Cpni), Mandatory Timely Disclosure To Reduce Consumer Harm, Financial Penalties To Incentivize Compliance (E.G., T-Mobile'S $31.5M Settlement), , T-Mobile, Walmart, And Kpu Implemented Encryption Post-Disclosure., Public Disclosure To Pressure Other Operators Into Securing Transmissions., Academic Outreach To Satellite Industry Stakeholders., .
Additional Questions
General Information
Who was the attacking group in the last incident ?
Last Attacking Group: The attacking group in the last incident were an Hackers, Unauthorized Third-Party, Former owner of a T-Mobile retail store, Cybercriminal, 21-year-old individual, Salt Typhoon espionage campaign, Academic Researchers (UC San Diego and University of Maryland)Potential State-Sponsored Actors (hypothetical)Potential Criminal Groups (hypothetical).
Incident Details
What was the most recent incident detected ?
Most Recent Incident Detected: The most recent incident detected was on 2021-12-01.
What was the most recent incident publicly disclosed ?
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2021.
Impact of the Incidents
What was the highest financial loss from an incident ?
Highest Financial Loss: The highest financial loss from an incident was More than £200,000.
What was the most significant data compromised in an incident ?
Most Significant Data Compromised: The most significant data compromised in an incident were personal plan information, billing account name, phone and account number, , email addresses, billing account numbers, IMSI, , Name, Billing Address, Phone Number, Account Number, Rate Plan and Features, , customer names, billing ZIP codes, phone numbers, email addresses, account numbers, account types, , social security numbers, financial information, government ID numbers, billing information, rate plans, , Customer data, addresses, phone numbers, dates of birth, , Customers' personal information, full name, contact information, account number and related phone numbers, T-Mobile account PIN, social security number, government-issued ID, date of birth, balance owing, internal codes used by T-Mobile to service customer accounts, number of lines, , full name, contact information, account number and related phone numbers, T-Mobile account PIN, social security number, government-issued ID, date of birth, balance due, internal T-Mobile service account servicer codes, number of lines, , contact information, sensitive account details, , customer addresses, drivers' licenses, social security numbers, , names, addresses, Social Security numbers, Driver’s License numbers, , T-Mobile account PINs, Driver's license numbers, , Names, Addresses, Social Security Numbers, Dates of Birth, , Customer names, Full dates of birth, Other account information, , names, drivers’ licenses, Social Security numbers, dates of birth, , , T-Mobile user call/text metadata (2,700+ users), In-flight Wi-Fi communications, Utility infrastructure comms (oil rigs, electricity providers), US military sea vessel names/locations, Mexican military/law enforcement intelligence (narcotics tracking, asset maintenance, mission details), Military/law enforcement personnel/equipment/facility locations and .
What was the most significant system affected in an incident ?
Most Significant System Affected: The most significant system affected in an incident were T-Mobile satellite backhaulIn-flight Wi-Fi systemsUtility infrastructure satellite comms (oil rigs, electricity providers)US military sea vessel communicationsMexican military/law enforcement satellite networks.
Response to the Incidents
What third-party assistance was involved in the most recent incident ?
Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was legal representation for industry groups (petitioners), , academic researchers (uc san diego, university of maryland), .
What containment measures were taken in the most recent incident ?
Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Shut down malicious, unauthorized access, Identified and shut down a security event involving account information, Identified and mitigated intrusion attempts, Encryption implemented by T-Mobile, Walmart and KPU post-disclosure.
Data Breach Information
What was the most sensitive data compromised in a breach ?
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were internal T-Mobile service account servicer codes, US military sea vessel names/locations, drivers' licenses, phone and account number, internal codes used by T-Mobile to service customer accounts, number of lines, social security number, account number and related phone numbers, Dates of Birth, drivers’ licenses, Driver's license numbers, Customer names, Utility infrastructure comms (oil rigs, electricity providers), account numbers, Full dates of birth, customer names, addresses, date of birth, Social Security numbers, social security numbers, Phone Number, Mexican military/law enforcement intelligence (narcotics tracking, asset maintenance, mission details), In-flight Wi-Fi communications, Account Number, Driver’s License numbers, customer addresses, Customer data, billing account name, full name, Social Security Numbers, Other account information, Name, dates of birth, balance due, government ID numbers, Customers' personal information, T-Mobile account PINs, IMSI, Rate Plan and Features, account types, financial information, Names, Billing Address, Addresses, T-Mobile user call/text metadata (2,700+ users), balance owing, email addresses, personal plan information, Military/law enforcement personnel/equipment/facility locations, contact information, government-issued ID, sensitive account details, rate plans, billing ZIP codes, phone numbers, billing information, T-Mobile account PIN, names and billing account numbers.
What was the number of records exposed in the most significant breach ?
Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 199.0M.
Regulatory Compliance
What was the highest fine imposed for a regulatory violation ?
Highest Fine Imposed: The highest fine imposed for a regulatory violation was T-Mobile: $31.5M (2021+ Incidents), AT&T: $13.3M (Cloud Vendor Breach), TracFone: $16M (Customer Data Safeguard Failures), .
What was the most significant legal action taken for a regulatory violation ?
Most Significant Legal Action: The most significant legal action taken for a regulatory violation was 14 federal criminal charges, Industry Petition to Block 2024 Rules (Rejected 2-1 by Sixth Circuit Court of Appeals), Congressional Review Act Challenge (Dismissed), , Opposition to T-Mobile’s motion to dismiss claims by Washington Attorney General, .
Lessons Learned and Recommendations
What was the most significant lesson learned from past incidents ?
Most Significant Lesson Learned: The most significant lesson learned from past incidents was Passive interception of broadcast signals may not violate laws, highlighting gaps in regulatory frameworks.
What was the most significant recommendation implemented to improve cybersecurity ?
Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Monitor Dark Web for Exfiltrated PII to Preempt Regulatory Action, Senators are urging the DOD to renegotiate contracts to strengthen cybersecurity defenses, Raise awareness among satellite operators about the risks of unencrypted broadcasts., Telecom Companies Should Audit PII Storage/Access to Comply with Expanded Reporting Rules, Mandate encryption for all satellite communications, especially for critical infrastructure and defense., Implement signal authentication and access controls for satellite transmissions., Develop international standards for secure satellite communications., Conduct regular audits of satellite security protocols by third-party assessors., Implement Automated Breach Detection to Meet 7-Day Deadline, Enhance Third-Party Vendor Security (e.g. and AT&T's Cloud Vendor Breach).
References
What is the most recent source of information about an incident ?
Most Recent Source: The most recent source of information about an incident are Reuters: 'US court upholds FCC rules requiring telecom firms to report breaches', Maine Office of the Attorney General, NJCCIC, FCC Press Release on 2024 Data Breach Rules, Wired Magazine, California Office of the Attorney General, T-Mobile, UC San Diego/University of Maryland Study (PDF), MLex, FCC Enforcement Bureau Settlements (T-Mobile, AT&T, TracFone), Washington State Office of the Attorney General and U.S. Court of Appeals for the Sixth Circuit Opinion.
What is the most recent URL for additional resources on cybersecurity best practices ?
Most Recent URL for Additional Resources: The most recent URL for additional resources on cybersecurity best practices is https://www.fcc.gov/document/fcc-adopts-new-data-breach-reporting-rules, https://www.reuters.com/legal/us-court-upholds-fcc-rules-requiring-telecom-firms-report-breaches-2024-05-29/, https://www.fcc.gov/enforcement .
Investigation Status
What is the current status of the most recent investigation ?
Current Status of Most Recent Investigation: The current status of the most recent investigation is Completed (Court Ruling Issued).
Stakeholder and Customer Advisories
What was the most recent stakeholder advisory issued ?
Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was Telecom Companies Must Update Incident Response Plans to Include 7-Day PII Breach Reporting, Legal Teams Should Review Congressional Review Act Implications for Future Challenges, Researchers notified affected companies/agencies; some implemented encryption, .
What was the most recent customer advisory issued ?
Most Recent Customer Advisory: The most recent customer advisory issued were an NJCCIC warned customers to be alerted of any suspicious activity., Alerted impacted customers via SMS notifications, Offered a free two-year subscription to my true identity online credit monitoring service for those whose financial information was exposed and Consumers May Receive More Breach Notifications Due to Expanded PII DefinitionFCC Encourages Customers to Monitor Credit Reports for Signs of Identity Theft.
Initial Access Broker
What was the most recent entry point used by an initial access broker ?
Most Recent Entry Point: The most recent entry point used by an initial access broker were an SMS Phishing, Routing Infrastructure, Stolen Employee Credentials and Email Vendor.
Post-Incident Analysis
What was the most significant root cause identified in post-incident analysis ?
Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Stolen Employee Credentials, Outdated Regulatory Framework (16 Years Without Updates)Industry Lobbying Against Stricter OversightInadequate Third-Party Risk Management (e.g., AT&T's Cloud Vendor Breach), Alleged failure to implement verifiable data protection commitmentsNon-compliance with data breach notification laws, Lack of encryption in satellite backhaul systemsOver-reliance on 'security through obscurity' (assumption that signals wouldn’t be intercepted)Absence of regulatory enforcement for satellite security standardsLow awareness of interception risks among satellite operators.
What was the most significant corrective action taken based on post-incident analysis ?
Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was FCC's Rulemodernization to Include PII (Beyond CPNI)Mandatory Timely Disclosure to Reduce Consumer HarmFinancial Penalties to Incentivize Compliance (e.g., T-Mobile's $31.5M Settlement), T-Mobile, Walmart, and KPU implemented encryption post-disclosure.Public disclosure to pressure other operators into securing transmissions.Academic outreach to satellite industry stakeholders..
.png)
Latest Global CVEs (Not Company-Specific)
Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.
Risk Information
cvss4
Base: 7.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
References
- https://github.com/angular/angular/commit/0276479e7d0e280e0f8d26fa567d3b7aa97a516f
- https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc
- https://github.com/angular/angular/commit/3240d856d942727372a705252f7c8c115394a41e
- https://github.com/angular/angular/releases/tag/19.2.16
- https://github.com/angular/angular/releases/tag/20.3.14
- https://github.com/angular/angular/releases/tag/21.0.1
- https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft deep ASN.1 structures that trigger unbounded recursive parsing. This leads to a Denial-of-Service (DoS) via stack exhaustion when parsing untrusted DER inputs. This issue has been patched in version 1.3.2.
Risk Information
cvss4
Base: 8.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs. These arcs may be decoded as smaller, trusted OIDs due to 32-bit bitwise truncation, enabling the bypass of downstream OID-based security decisions. This issue has been patched in version 1.3.2.
Risk Information
cvss4
Base: 6.3
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13 and 8.0.2, working with large buffers in Lua scripts can lead to a stack overflow. Users of Lua rules and output scripts may be affected when working with large buffers. This includes a rule passing a large buffer to a Lua script. This issue has been patched in versions 7.0.13 and 8.0.2. A workaround for this issue involves disabling Lua rules and output scripts, or making sure limits, such as stream.depth.reassembly and HTTP response body limits (response-body-limit), are set to less than half the stack size.
Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions from 8.0.0 to before 8.0.2, a NULL dereference can occur when the entropy keyword is used in conjunction with base64_data. This issue has been patched in version 8.0.2. A workaround involves disabling rules that use entropy in conjunction with base64_data.
Risk Information
cvss3
Base: 7.5
Severity: LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Access Data Using Our API
Get company history
curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=t-mobile' -H 'apikey: YOUR_API_KEY_HERE'
RapidWhat Do We Measure ?
Incident
Finding
Grade
Digital Assets
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Network Security
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
SBOM (Software Bill of Materials)
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
CMDB (Configuration Management Database)
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Threat Intelligence
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
