US Telecom T-Mobile Suffers Data Breach Exposing Personal Information of 40 Million Users Due to Hacking

[Image source=AP Yonhap News]

[Asia Economy Reporter Hyun-ui Cho] T-Mobile, the second largest mobile carrier in the United States, suffered a hacking attack resulting in the personal information of over 40 million customers being leaked.

On the 18th (local time), T-Mobile disclosed that hackers stole personal information including the names, birthdates, Social Security Numbers (SSN), and driver's license data of more than 40 million existing and potential customers, according to the Wall Street Journal (WSJ).

The victims include approximately 7.8 million postpaid subscribers, 850,000 prepaid phone customers, and about 4,000 former and potential customers who applied for credit checks with T-Mobile. Some of these individuals overlap across groups, but the exact scale is unknown.

WSJ described the incident as "a bold heist that could provide criminals with digital keys to commit various online fraud crimes."

T-Mobile reset the account Personal Identification Numbers (PINs) of the prepaid customers whose information was leaked and advised postpaid subscribers to take the same action.

They also announced they would provide McAfee's identity protection services free of charge for two years. Additionally, they stated that they identified and closed the access points hackers used to infiltrate their servers.

T-Mobile called the hacking a "highly sophisticated cyberattack" but did not disclose specific methods or security vulnerabilities exploited in the attack.

The stolen personal information is already being sold on some online hacker forums. WSJ pointed out that this information could be used for identity theft or scams such as SIM swapping.

The U.S. Federal Communications Commission (FCC) has launched an investigation into the incident.

Allison Nixon, Chief Research Officer at cybersecurity firm Unit 221B, explained, "The typical lifecycle of a stolen personal information database is that it first gets into the hands of a few people and then spreads widely," adding, "Eventually, the hacked database becomes fully public."