T-Mobile says new data breach caused by SIM swap attacks

T-Mobile confirmed that recent reports of a new data breach are linked to notifications sent to a "very small number of customers" who fell victim to SIM swap attacks.

"We informed a very small number of customers that the SIM card assigned to a mobile number on their account may have been illegally reassigned or limited account information was viewed," a T-Mobile spokesperson told BleepingComputer.

"Unauthorized SIM swaps are unfortunately a common industry-wide occurrence, however this issue was quickly corrected by our team, using our in-place safeguards, and we proactively took additional protective measures on their behalf."

T-Mobile refused to provide additional details when asked for more info on the total number of affected customers and the method used by the attackers to pull off the SIM swap attacks successfully.

"We are not providing any additional information at this time. Thank you!," a company spokesperson told BleepingComputer.

SIM swapping (also known as SIM hijacking) makes it possible for attackers to take control of a target's mobile phone number by tricking or bribing the carrier's employees to reassign the numbers to attacker-controlled SIM cards.

This enables the threat actors to take control of their victims' phone numbers and use them to bypass SMS-based multi-factor authentication (MFA), steal their credentials, log into the victims' bank accounts to steal money, or hijack their online accounts by changing the passwords.

All T-Mobile customers be on the lookout for any suspicious text messages or emails pretending to be from T-Mobile. Don't click any links if you receive one, as attackers could use them to harvest your credentials.

T-Mobile provides information on preventing account takeover attempts on this support page.

T-Mobile is taking immediate steps to help protect all individuals who may be at risk from this cyberattack. If you have any questions, send us a DM and we can discuss steps to increase your account security. ^KenStone

— T-Mobile Help (@TMobileHelp) December 28, 2021

Series of data breaches

T-Mobile was the victim of multiple data breaches during the last four years, including a very similar one in February 2021 when attackers used an internal T-Mobile application to target up to 400 customers in SIM swap attempts.

In total, T-Mobile has disclosed six data breaches since 2018:

• In 2018, info belonging to millions of T-Mobile customers was accessed by hackers.
• In 2019, T-Mobile exposed prepaid customers' data.
• In March 2020, hackers gained access to T-Mobile employees' email accounts.
• In December 2020, hackers accessed exposed customer proprietary network information (phone numbers, call records).
• In February 2021, threat actors targeted hundreds of users in SIM swap attacks after gaining access to an internal T-Mobile application.
• In August 2021, attackers brute-forced their way through T-Mobile's network after gaining access to testing environments.

The FBI shared guidance on defending against SIM hijacking attacks following an increase in the number of SIM hijacking attacks targeting cryptocurrency investors and adopters.

The Federal Trade Commission (FTC) has info on securing personal information on your phone and keeping personal info secure online.