Posted on January 20, 2023 at 7:55 AM
Hacker Accesses 37M Customers’ Data Amid T-Mobile Data Breach
On Thursday, the 20th of January, 2023, T-Mobile, a telecom giant, has revealed that a hacker had managed to gain access to an entire trove of personal data. According to the filing, the hacker had managed to breach the data of $37 million people.
37 Million Customers Had Data Compromised
According to T-Mobile, the so-called “bad actor” had managed to steal data regarding the billing addresses, names, phone numbers, emails, account numbers, dates of birth, and other details. The telecom giant stated that the hacker in question had also managed to steal data regarding the plan features of these various accounts as well as the number of lines on said accounts.
As per the filing made by the SEC, T-Mobile stated that the breach was detected over a month after it had occurred. The actual date of detection was stated to be the 5th of January, 2023. T-Mobile also stated that once they discovered the breach, it was less than a day before the holes were plugged, and the vulnerability used by the hacker was repaired.
Plugging The Gaps
T-Mobile stated that they had used external cybersecurity experts in order to investigate the breach. According to T-Mobile, their policies and systems allowed for a lot of sensitive information to be protected despite the breach.
According to T-Mobile, the hacker in question couldn’t access the company’s system. Instead, they exploited a vulnerability within an application programming interface or API. The filing showed that the API the malicious actor had used, didn’t give him access to Customer Payment Card Information, or PCI. Other bits of data that T-Mobile stated were protected were driver’s licenses, social security numbers, and any other government ID numbers.
T-Mobile stated that they are convinced the malicious actor in question managed to gain access to breach a limited part of T-Mobile’s systems back on the 25th of November, 2022.
A Constant Effort
In the public statement, T-Mobile made it clear that, at the time, the breach had been fully contained. Even so, T-Mobile made it clear that the investigation was still ongoing, and that developments might pop up unexpectedly. Furthermore, the filing stated that a select number of federal agencies have also been notified, with T-mobile working with law enforcement agencies about the matter at large. T-mobile also assured the public that the individual customers who potentially suffered a data breach had also been notified of the event.
It should be noted that T-Mobile has already revealed back in 2021 that the telecom giant had started a multi-year operation. This operation sees T-Mobile working closely with external cybersecurity experts in a bid to enhance the capabilities of T-Mobile’s cybersecurity suite. Furthermore, they are aiming to transform their approach to cybersecurity in general.
T-Mobile promises that their progress in regard to their cybersecurity has significantly increased, affirming the fact that their greatest priority is the security of their customer’s data.
On a bit more bitter note, the company speculates that there may be significant expenses that will occur thanks to this data breach.
T-Mobile Sffering Hacks since 2018
T-Mobile explained that they could not predict what the full impact of this event could be on their customers. As it stands now, T-Mobile doesn’t expect the event to affect the company in terms of material value, but time will tell whether or not that is true.
Ever since 2018, it seems that T-Mobile has been subject to numerous hacking operations. Some of the highlights of these events is the call records of customers being compromised back in January of 2021. In August of that same year, T-Mobile suffered a breach that compromised its credit application data. A significant attack occurred in December of that year, when a malicious actor managed to access customer info and executed SIM-swapping attacks.
A Tad Late On The Trigger
In April of 2022, the telecommunications giant was hacked by Lasus$, a malicious hacking group. The group in question managed to purchase the credentials of a T-Mobile employee online, stealing the company’s source code.
Time will tell if T-Mobile can recover from this constant state of data breaches. It’s become abundantly clear that the telecommunications giant decided to update its cybersecurity section a tad too late, suffering the effects of it since 2018. With luck, the company will be capable of repairing its reputation in time, and manage to revamp its cybersecurity sector. It’s clear, however, that cybersecurity is an ongoing war between security experts and malicious actors, one that won’t go away any time soon.
