T-Mobile says recent data hack exposed over 47 million people's info (Updated)

Update: August 20, 2021 (02:00 PM ET): T-Mobile’s latest update on its website about the massive data breach brings more bad news. In addition to the personal info leak of the 7.8 million current postpaid customers (see update below), T-Mobile has identified that “the phone numbers, as well as IMEI and IMSI information, the typical identifier numbers associated with a mobile phone, were also compromised.”

T-Mobile has also found that another 5.3 million current postpaid customer accounts have also been compromised, which includes associated customer names, addresses, date of births, phone numbers, IMEIs, and IMSIs. However, T-Mobile notes that SSNs and or driver’s license or other ID information weren’t compromised with these additional accounts. The company has also identified another 667,000 compromised accounts of former or prospective customers, in addition to the 40 million previously mentioned.

In somewhat welcome news, T-Mobile says that there is “no indication that the data contained in any of the stolen files included any customer financial information, credit card information, debit or other payment information.”

The company is reaching out to millions of customers and providing various solutions to help them secure their accounts. This includes two years of free identity protection services with McAfee’s ID Theft Protection Service to anyone affected by the breach. All eligible T-Mobile customers can also sign up for scam-blocking protection through the Scam Shield service for free. You can find more information about the data breach and what you can do to secure your account here.

Update: August 18, 2021 (11:28 AM ET): T-Mobile has posted a new update on the data hack on its website. It now says that the personal info of over 7.8 million current postpaid customers was included in the stolen data files, along with the personal info of over 40 million other people who are either former customers or who were possible users that applied for credit with T-Mobile. Some of that data included “first and last names, date of birth, SSN, and driver’s license/ID information.”

The carrier claims that “no phone numbers, account numbers, PINs, passwords, or financial information” from postpaid users were included in the files that were taken during the hack. However, T-Mobile is still advising all of its postpaid customers to change their PIN number as a proactive measure. It will also offer two years of free identity protection services to everyone affected by the hack.

As far as the company’s prepaid customers, T-Mobile has confirmed that the accounts of 850,000 active prepaid user names, phone numbers, and account PINs were part of the hack. T-Mobile says it has gone ahead and reset all of those PIN numbers and will be informing those customers soon. Some inactive prepaid user info was exposed as well, but T-Mobile says no financial info was in those files.

Original article: August 16, 2021 (1:26 AM ET): A massive data breach may have exposed the sensitive personal information of as many as 100 million T-Mobile customers. The information reportedly includes people’s social security numbers, phone numbers, physical addresses, IMEI numbers, and driver’s licenses.

According to Motherboard, the hacker claims to have obtained the information from multiple T-Mobile servers. The publication has seen samples of the data and confirms that it contains accurate details about T-Mobile users.

The hacker is also looking to make a pretty penny by selling this huge trove of personal data on an underground forum. The asking price is six bitcoins, which amounts to around $270,000, for a subset of data of 30 million T-Mobile customers.

“I think they already found out because we lost access to the backdoored servers,” the sellers told Motherboard, referring to T-Mobile’s actions against the breach. However, the hacker claims to have already downloaded the customer data locally. “It’s backed up in multiple places,” they said.

Related: How to cancel T-Mobile services

Meanwhile, T-Mobile has started investigating the matter. The company issued the following statement in response to the alleged hack:

We are aware of claims made in an underground forum and have been actively investigating their validity. We do not have any additional information to share at this time.

It’s unclear what’ll happen to the stolen data of millions of T-Mobile users. If it ends up being sold, it could potentially harm all the affected users and also spark lawsuits against T-Mobile.

We’ll update this article if T-Mobile confirms the hack or shares any other information about it.