T-Mobile Confirms Insider Breach Exposing Sensitive Customer Data T-Mobile has disclosed a recent insider breach involving unauthorized access to a single customer’s sensitive information. According to a filing with the Maine Attorney General’s Office, the compromised data included the victim’s full name, physical and email addresses, birthdate, account number, phone number, T-Mobile account PIN, Social Security number, and driver’s license number. A T-Mobile spokesperson confirmed that the incident stemmed from a vendor employee improperly accessing the customer’s records. The company emphasized that no credentials were compromised and that law enforcement and the affected individual were promptly notified. The breach appears to be an isolated case, though questions remain about whether the reported "1" affected account was a placeholder in initial disclosures. This incident follows a string of high-profile security failures at T-Mobile, including a 2023 API exploitation attack that exposed 37 million customer accounts. The company continues to face scrutiny over its data protection practices.

T-Mobile Data Breach Exposes Personal Information of 47.8 Million Individuals T-Mobile confirmed a data breach impacting 47.8 million current, former, and prospective customers, after threat actors stole records from the company’s systems. The breach, discovered after the data appeared on an online forum, exposed sensitive information including names, dates of birth, Social Security numbers, and driver’s license or ID details. The incident affected multiple customer groups differently: - 7.8 million current postpaid customers had personal data compromised. - Over 40 million former or prospective customers who had applied for credit with T-Mobile were also impacted. - 850,000 active prepaid customers had their phone numbers and account PINs exposed, prompting T-Mobile to reset affected PINs and secure the leak. While postpaid and former/prospective customers did not have financial information, account numbers, or passwords exposed, the breach highlights varying levels of risk across customer segments, particularly for prepaid users whose account security controls were directly compromised. The incident underscores the large-scale exposure of identity data and the need for organizations to assess breach impacts based on account type and exposed data elements. T-Mobile has since taken steps to mitigate the breach, including shutting down the unauthorized access and implementing protective measures for affected accounts.

T-Mobile Discloses Data Breach Affecting Maine Resident T-Mobile reported a data breach affecting at least one customer in Maine, disclosed to the state’s Attorney General on March 31, 2026. The company detected the incident on March 5, 2026, after its monitoring systems identified unauthorized access to a customer’s account. The exposed data included sensitive personal information: full name, address, email, account number, phone numbers, T-Mobile account PIN, driver’s license number, date of birth, and Social Security number. However, financial account details and call records were not compromised. In response, T-Mobile reset the affected customer’s account PIN to prevent further unauthorized access. The company is providing two years of free credit monitoring and identity theft detection via TransUnion’s myTrueIdentity service, with enrollment required by June 30, 2026. Affected individuals were notified by written letter, which included an activation code for the service. T-Mobile advised the impacted customer to review account security, update security questions, and monitor for unauthorized credit activity. Support contacts for account inquiries and credit monitoring assistance were also provided.

A research team from UC San Diego and the University of Maryland intercepted unencrypted satellite communications, exposing critical vulnerabilities in T-Mobile’s backhaul systems. Over a nine-hour session, they accessed phone numbers, call logs, and text messages of over 2,700 users via T-Mobile’s satellite links. While the interception was one-sided (only incoming data to users was exposed, not outgoing), the breach revealed systemic failures in encryption protocols. The researchers used off-the-shelf equipment costing under $600 to exploit this flaw, demonstrating how easily malicious actors could replicate the attack. T-Mobile was notified and later implemented encryption, but the incident highlights the risks of unsecured satellite-based cellular infrastructure, where location data, communication metadata, and potentially sensitive user interactions were left exposed to passive eavesdropping. The breach underscores the broader industry neglect of satellite security, with implications for both consumer privacy and national security, given that military and law enforcement communications were similarly vulnerable in the study.

Hacker Claims Massive T-Mobile Data Breach, Company Denies Involvement An unnamed hacker recently posted on a dark web forum, alleging the theft of 64 million records containing sensitive customer data purportedly linked to T-Mobile. The leaked database, reportedly obtained as early as June 1, 2025, includes full names, dates of birth, tax IDs, postal and email addresses, phone numbers, device IDs, cookie IDs, and IP addresses. T-Mobile swiftly denied any connection to the breach, stating that the data "does not relate to T-Mobile or our customers." Cybersecurity researchers at Cybernews analyzed the sample but could not verify its authenticity, noting that while some phone numbers matched past T-Mobile breaches, the full dataset’s legitimacy remains unconfirmed. The 64 million "lines" may not equate to 64 million unique individuals. If legitimate, the exposed data could fuel targeted phishing attacks, identity theft, and fraud. This incident follows a pattern: last year, threat actor IntelBroker claimed to have breached T-Mobile, stealing source code and other internal files—claims the company also dismissed. As of now, the origin and validity of the leaked data remain disputed.

T-Mobile, a major telecom service provider with contracts across various divisions of the US Department of Defense, including the Army, Air Force, and Navy, encountered attempts of hacking activity through its routing infrastructure. Although the company has not confirmed that the attack was the Salt Typhoon espionage campaign, it identified and mitigated the intrusion attempts. Despite this, vulnerabilities remain in the telecom infrastructure. Senators are urging the DOD to renegotiate contracts to strengthen cybersecurity defenses, pointing out the risks of surveillance and potential espionage.

T-Mobile experienced its second data breach of 2023; 100 of consumers' personal information was exposed to threat actors. The security incident only affected 836 customers, which is a small number. Personal bank account information and call history, according to the carrier, were unaffected by the security lapse. Each customer's information was collected differently, but it could have included their full name, contact information, account number and related phone numbers, T-Mobile account PIN, social security number, government-issued ID, date of birth, balance due, and internal T-Mobile service account servicer codes, as well as the number of lines. They can get free credit monitoring and identity theft detection services from T-Mobile for two years.

Threat actors gained access to the private data of 100 of customers of T-Mobile beginning in late February 2023 as a result of the second data breach of 2023. Only 836 clients, in total, were affected by the security compromise. The company claims that the security breach had no impact on call history or information from personal bank accounts. Depending on the customer, different information was obtained, but it could have included the following: full name, contact information, account number and related phone numbers, T-Mobile account PIN, social security number, government-issued ID, date of birth, balance owing, internal codes used by T-Mobile to service customer accounts (such as rate plan and feature codes), and the number of lines.

T-Mobile’s Repeated Data Breaches: A Decade of Cybersecurity Failures Since 2015, T-Mobile has suffered a series of high-profile data breaches, exposing the personal information of hundreds of millions of customers current, former, and even prospective. The incidents, varying in scale and method, have compromised nearly every category of sensitive data the company holds, from Social Security numbers (SSNs) to account PINs. Below is a breakdown of the most significant breaches, their impact, and the legal fallout. ### A Timeline of T-Mobile’s Breaches 2015: The Experian Third-Party Breach Though not a direct attack on T-Mobile, the company’s reliance on Experian for credit checks led to the exposure of 15 million customers’ data, including SSNs, driver’s license numbers, and passport details. Experian notified affected individuals and offered credit monitoring. 2018: Two Million Records Exposed An attacker accessed 2 million customers’ data, including names, billing ZIP codes, phone numbers, email addresses, and encrypted passwords. T-Mobile claimed the breach was contained upon discovery. 2019–2020: Smaller but Repeated Incidents - November 2019: Unauthorized access to prepaid customer accounts (exact number undisclosed). - March 2020: A breach at an email vendor exposed some customers’ personal and financial data. - December 2020: Attackers accessed proprietary network information, including phone numbers and call records. 2021: The Largest Breach in T-Mobile’s History The most damaging incident to date exposed 76.6 million individuals’ data, including: - 7.8 million current postpaid customers: Names, dates of birth, SSNs, and driver’s license/ID numbers. - 40 million former/prospective customers: SSNs and driver’s license data. - 850,000 prepaid customers: Names, phone numbers, and account PINs. Hacker John Erin Binns claimed responsibility, stating he accessed T-Mobile’s systems via an unprotected GPRS gateway using brute-force tactics. His alleged motive was retaliation against the U.S. government. Binns was indicted in 2024 and arrested in Turkey, where extradition proceedings are ongoing. 2023: API Breach Affects 37 Million Customers Discovered in January 2023, the breach stemmed from a vulnerable API endpoint exploited since November 25, 2022. The exposed data included names, billing addresses, phone numbers, emails, dates of birth, and account details but no SSNs, passwords, or financial information. T-Mobile contained the breach within 24 hours of detection. A separate April 2023 incident affected 836 customers, exposing SSNs, government IDs, and account PINs a smaller but more targeted attack. ### Legal and Financial Consequences The 2021 breach triggered multiple class-action lawsuits, culminating in a $350 million settlement in July 2022 the largest data breach settlement in U.S. history at the time. T-Mobile also committed $150 million to cybersecurity improvements. In September 2024, the FCC imposed a $15.75 million fine and required an additional $15.75 million in security investments, mandating: - Adoption of zero-trust architecture. - Phishing-resistant multi-factor authentication (MFA) across internal networks. - Data minimization practices. - Third-party security assessments. ### Impact and Ongoing Risks T-Mobile’s breaches have left a lasting legacy, with stolen data resurfacing years later in underground markets. The 2021 breach alone exposed SSNs for tens of millions, increasing identity theft risks. The company’s repeated failures underscore systemic security weaknesses, despite regulatory pressure and financial penalties. For affected customers, the breaches highlight the long-term risks of data exposure, with compromised information often resold or combined with other breach datasets. While T-Mobile has implemented reforms, the damage to customer trust and the potential for future misuse of stolen data remains a persistent concern.

T-Mobile suffered another breach incident that affected around 37 million customers. The stolen data included addresses, phone numbers, and dates of birth. The carrier has no evidence (at least so far) that any passwords, pins, bank account, credit card information, or Social Security numbers.

The Washington State Office of the Attorney General reported that T-Mobile USA experienced an unauthorized access data breach affecting 772,593 individuals. The breach occurred between November 25, 2022, and January 5, 2023, potentially exposing customer names, full dates of birth, and other account information, but not passwords, payment methods, or Social Security numbers.

T-mobile company suffered a significant data breach in a cyber attack in August 2022. A former owner of a T-Mobile retail store in Eagle Rock was guilty of 14 federal criminal charges related to his $25 million scheme to enrich himself by stealing T-Mobile employee credentials and unlawfully accessing the company's internal computer systems to illicitly "unlock" and "unblock" cellphones. Around 25 million customers' data was compromised in the attack.

T-Mobile customers are being targeted by ongoing phishing campaign. The hackers are using malicious links with unblockable texts sent via SMS (Short Message Service) group messages. The attacker are using the data breached form the company in the past. The NJCCIC warned the customers to be alerted of any suspicious activity.

T-mobile company suffered a significant data breach in a cyber attack in December 2021. The customers fell prey to the attacker and suffered SIM swapping attacks and exposed personal information like personal plan information, billing account name, phone and account number, and others. Around 50 million customers' data was compromised in the breach.

In August 2021, T-Mobile experienced a significant cybersecurity breach, resulting in the theft of data from about 50 million existing and potential customers. The information compromised included customer addresses, drivers' licenses, and social security numbers. This breach was orchestrated by a 21-year-old who claimed to have accessed approximately 106GB of T-Mobile's data. The exposure of such sensitive personal information potentially puts millions of individuals at risk of identity theft and fraud, raising serious privacy and security concerns.

The California Office of the Attorney General reported on August 25, 2021, that T-Mobile USA experienced a data breach on July 22, 2021, involving the unauthorized access of personal customer information. The breach potentially affected data such as names, drivers’ licenses, Social Security numbers, and dates of birth among others, although the specific number of individuals impacted is unknown.

T-Mobile faced a series of high-profile data breaches dating back to 2021, resulting in the unauthorized exposure of customers’ personally identifiable information (PII), including Social Security numbers, email addresses, and other sensitive data. The breaches violated the FCC’s updated 2024 regulations, which mandate reporting incidents involving 500+ customers’ PII within seven business days. The company was penalized with a $31.5 million fine and forced to overhaul its cybersecurity practices as part of a settlement with the FCC. The breaches compromised customer trust, exposed critical personal data to potential misuse (e.g., identity theft, fraud), and highlighted systemic vulnerabilities in T-Mobile’s data protection frameworks. The FCC’s enforcement underscored the severity of failing to safeguard PII, particularly under stricter regulatory scrutiny. The incident aligns with broader industry trends where telecom providers face escalating legal and financial repercussions for inadequate breach responses.

T-Mobile suffered a data breach caused after an email vendor was hacked in an incident that exposed the personal and financial information of some of its customers. Some of the compromised email accounts contained T-Mobile customer information such as social security numbers, financial information, government ID numbers, billing information, and rate plans. T-Mobile notified the affected customers affected by sending text messages and identified and shut down a security event involving account information. T-Mobile also offered a free two-year subscription to my true identity online credit monitoring service for those whose financial information was exposed.

The account information of an undisclosed number of customers of T-mobiles was breached by an unauthorized third-party. The accessed data included name and billing address, phone number, account number, rate plan and features, such as whether you added an international calling feature all related to prepaid service account. T-mobile alerted all impacted customers via SMS notifications and shut down malicious, unauthorized access to some information related to your T-Mobile prepaid wireless account.

T-Mobile USA suffered a data breach incident after its cyber-security team discovered unauthorized access to its customers' data. An attacker exfiltrated personal data such as customer names, billing ZIP codes, phone numbers, email addresses, account numbers, and account types (prepaid or postpaid). However, he did not gain access to passwords, social security numbers, or any financial information. T-mobile notified that 3% of its customers were affected by the attack.

T-Mobile suffered a massive data breach in August 2023, exposing the personal information of 37 million customers, including names, billing addresses, emails, phone numbers, dates of birth, and account details. The breach originated from a malicious actor exploiting an API vulnerability, gaining unauthorized access to customer data over a month-long period. While T-Mobile confirmed no financial data (e.g., credit cards, SSNs) or passwords were stolen, the exposed information heightened risks of phishing, SIM-swapping, and identity fraud. The incident marked the ninth major breach for T-Mobile since 2018, raising concerns over its cybersecurity practices. Regulators and customers criticized the company’s failure to prevent recurring attacks, despite prior settlements and promises to bolster security. The breach’s scale and the sensitivity of leaked data—though not financial—posed significant reputational damage and operational disruptions, including customer churn and potential lawsuits.

There was a vulnerability found. T-Mobile classified it as “critical,” patched the bug and gave the researcher a $5,000 reward. Hackers accessed customers’ sensitive information such as email addresses, billing account numbers, and their IMSI, the phone’s standardized unique number that identifies subscribers. They also hijacked their phone numbers and tried stealing money from their banking accounts linked to those numbers.

A cybercriminal has admitted to hacking businesses like Uber, Sainsbury's, and Groupon to sell customers' personal information on the dark web. The other targets included Nectar, T-Mobile, Asda, Ladbrokes, Coral, and Argos. The data comprised all the information required to complete an online purchase and was then promoted and sold to clients through his dark website. The firm is thought to have lost more than £200,000 due to the theft, although no financial data was collected. West pleaded guilty to two counts of conspiring to defraud, one count of hacking a computer, four counts of possessing and supplying marijuana, two counts of having criminal property, and one crime of money laundering Bitcoins. The leaked data is related to a security breach on a third-party vendor.

The California Office of the Attorney General reported on October 1, 2015, that T-Mobile USA, Inc. experienced a data breach on September 14, 2015, involving unauthorized access to Experian servers. The breach potentially exposed personal information of customers, including names, addresses, social security numbers, and dates of birth, but no banking or payment information was compromised.

The California Office of the Attorney General reported a data breach involving T-Mobile US on December 30, 2013. The breach involved unauthorized access to a file stored on servers managed by a T-Mobile supplier, potentially exposing personal information such as names, addresses, Social Security numbers, and/or Driver’s License numbers. The date of the breach discovery was in late November 2013.