T-Mobile discloses second data breach since the start of 2023

T-Mobile disclosed the second data breach of 2023 after discovering that attackers had access to the personal information of hundreds of customers for more than a month, starting late February 2023.

Compared to previous data breaches reported by T-Mobile, the latest of which impacted 37 million people, this incident affected only 836 customers. Still, the amount of exposed information is highly extensive and exposes affected individuals to identity theft and phishing attacks.

"In March 2023, the measures we have in place to alert us to unauthorized activity worked as designed and we were able to determine that a bad actor gained access to limited information from a small number of T-Mobile accounts between late February and March 2023," the company said in data breach notification letters sent to affected individuals just before the weekend, on Friday, April 28, 2023.

T-Mobile said the threat actors didn't gain access to call records or affected individuals' personal financial account info, but the exposed personally identifiable information contains more than enough data for identity theft.

While the exposed information varied for each of the affected customers, it could include "full name, contact information, account number and associated phone numbers, T-Mobile account PIN, social security number, government ID, date of birth, balance due, internal codes that T-Mobile uses to service customer accounts (for example, rate plan and feature codes), and the number of lines."

After detecting the security breach, T-Mobile proactively reset account PINs for impacted customers and now offers them two years of free credit monitoring and identity theft detection services through Transunion myTrueIdentity.

A T-Mobile spokesperson was not immediately available for comment when contacted by BleepingComputer earlier today to ask for more details.

Second data breach disclosed in 2023

This is the second such incident T-Mobile has revealed since the start of the year, with the previous data breach disclosed on January 19, after attackers stole the personal information of 37 million customers by abusing a vulnerable Application Programming Interface (API) in November 2022.

The mobile carrier spotted the threat actors' malicious activity on January 5 and cut off their access to its systems within 24 hours.

T-Mobile described the data stolen in the January breach as "basic customer information," including "name, billing address, email, phone number, date of birth, T-Mobile account number and information such as the number of lines on the account and plan features."

Since 2018, the mobile carrier has disclosed seven other data breaches, including one that exposed the information of roughly 3% of all T-Mobile customers.

Other incidents reported by T-Mobile during the last few years include:

• In 2019, T-Mobile exposed the account information of an undisclosed number of prepaid customers.
• In March 2020, T-Mobile employees were affected by a data breach exposing their personal and financial information.
• In December 2020, threat actors accessed customer proprietary network information (phone numbers, call records).
• In February 2021, an internal T-Mobile application was accessed by unknown attackers without authorization.
• In August 2021, hackers brute-forced their way through the carrier's network following a breach of a T-Mobile testing environment.
• In April 2022, the Lapsus$ extortion gang breached T-Mobile's network using stolen credentials.

---

Update May 01, 16:25 EDT: A T-Mobile spokesperson provided the following statement after the article was published, but didn't reply to a follow-up email asking for more info on how the credentials used in the incident were compromised and if they belonged to employees. 

We notified a small number of customers that our systems and processes worked to detect and stop a bad actor who was accessing accounts using compromised credentials. No personal financial account information or call records were included. We take these issues seriously and have taken steps to proactively protect the impacted customer accounts and to help prevent recurrence. We’ll continue to investigate what occurred to expand the safeguards we have in place. - T-Mobile