T-Mobile claims hacker obtained data from 37 million customer accounts

T-Mobile said Thursday that a hacker had harvested data, including names, dates of birth and phone numbers, from 37 million customer accounts, the company’s second major breach in less than two years.

In a securities filing, T-Mobile said it first discovered a “bad actor” was getting the data on Jan. 5. With the help of outside cybersecurity experts, the mobile service provider stopped the leak the next day, he said.

The company said there was no evidence that its systems or network had been compromised, adding that the mechanism exploited by the hacker did not allow access to more sensitive information such as social security numbers, government identification numbers, passwords or payment card information.

“We understand that an incident like this impacts our customers and regret that this has happened,” T-Mobile said in a statement.

Information exposed included names, billing and email addresses, phone numbers, dates of birth, T-Mobile account numbers, and information such as account lines and plan features. Many accounts did not include all of this data. The company said it has begun notifying some of the affected customers in accordance with state and federal requirements.

T-Mobile said it is continuing to investigate the exposure and has notified federal authorities. The company said it believed the hacker started recovering data on Nov. 25 through an application programming interface, a common piece of code that allows software to communicate with other software.

A cyberattack in 2021 exposed data from nearly 77 million T-Mobile customer accounts, including names, social security numbers and driver’s license information. As a result, the company agreed to both pay $350 million to settle customer complaints and spend $150 million to improve its cybersecurity practices and technologies.

In Thursday’s filing, T-Mobile said it has “made substantial progress to date” on those upgrades. He also acknowledged he could face “significant expenses” as a result of the latest breach.