T-Mobile Discloses Recent Security Breach Impacting 2M Customers, No Financial Data Compromised

Discussion in 'iOS Blog Discussion' started by MacRumors, Aug 24, 2018.

  1. MacRumors macrumors bot


    Apr 12, 2001

    T-Mobile and its subsidiary MetroPCS today disclosed a recent incident where hackers gained "unauthorized access to certain information" of its customers, which the companies have already reported to the police and shut down. The security breach occurred earlier this week on Monday, August 20, and affected two million customers (via Motherboard).


    T-Mobile promises that no financial data, credit card information, social security numbers, or passwords were compromised in the breach. However, "some of your personal information may have been exposed," the company states in the letter shared online, including one or more of the following: name, billing zip code, phone number, email address, account number, and account type (prepaid or postpaid).

    A T-Mobile spokesperson says that the security breach affected "slightly less than" three percent of its 77 million customers, but did not reference a specific number. The incident reportedly happened "early in the morning" on August 20, and was perpetrated by hackers part of "an international group" that accessed T-Mobile servers through an API that "didn't contain any financial data or other very sensitive data."

    The intrusion was discovered by T-Mobile's cybersecurity team the same day:
    T-Mobile is now reaching out to notify all affected customers, and "if you don't receive a notification then that means your account was not among those impacted by this incident." The breach occurred less than a week after T-Mobile announced its new customer service initiative "Team of Experts."

    Article Link: T-Mobile Discloses Recent Security Breach Impacting 2M Customers, No Financial Data Compromised
  2. Amacfa macrumors 68000


    May 22, 2009
    Here’s a great idea, stop centralizing databases.

    Decentralize the customer information so they have direct access.

    That wau when a hacker comes around, it’s not just one or two targets with MILLIONS of person info, instead they would need to target one person at a time
  3. shareef777 Suspended


    Jul 26, 2005
    Chicago, IL
    There's no solution that's hacker-proof. A script can be written to pull the data of one customer and re-run a million times automatically to pull the data of all the others.
  4. gsmornot macrumors 68030


    Sep 29, 2014
    Not being a physical asset this would not apply. If you can see the records from a single machine it does not matter where they are stored. It would not make sense to have multiple systems for customer data, the agents alone would take a lot of time trying to find the user. So, option two is better management of access.
  5. pika2000 macrumors 601

    Jun 22, 2007
    This is what I hate about news like this. We will never knew what happened, and just had to put a blind trust on these companies.
  6. OldSchoolMacGuy Suspended


    Jul 10, 2008
    Not only are they dedicated to giving customers more but they're also dedicated to giving hackers more.
    --- Post Merged, Aug 24, 2018 ---
    Trusted them and they got your data stolen but you should totally trust them again.
  7. stainless macrumors member


    Jul 2, 2007
    That's because it's an on going "investigation" and by publicly stating what was stolen, might cause some script kiddy to take an old db (Yahoo hacked data, etc) and create a false trail just for the hell of it. Additionally, the hackers might not exactly know what they have, if the data was using a basic encryption (which it should) you don't want to give them any insights.

    What good would come to anyone, who was not affected, to know exactly what was compromised other than for useless knowledge? (don't take that question personally, it's not targeted directly at you, not trying to get into an argument.)
  8. Capeto macrumors regular


    Jul 9, 2015
    Yeah, I got a text message yesterday saying my info was compromised.

    I hope whoever steals my identity enjoys the student loan debt!
  9. djdj macrumors member

    Jul 14, 2008
    A properly written API has rate limiting. And reports unusual activity. Looks like the developers weren't very security-conscious.
  10. CPx macrumors 6502a

    Sep 6, 2013
  11. TheShadowKnows! macrumors 6502a


    Sep 30, 2014
    National Capital Region
    Beware that this is the perfect situation whereby you are the target of "spear phishing"

    Here is how that would work:
    1. The news are out that T-Mobile servers have been compromised, and that a small fraction of subscribers will receive an email warning them that they may have been the target.
    2. You receive such email. The email appears to be authentic; but it is not and yet it appears crafted by T-Mobile Customer Service.
    3. It includes within the email body an embedded URL requesting you, the recipient, to click and login onto your T-Mobile account, and "change your password".
    4. The URL is fake, and points to hackers' backend servers.
    5. Unaware, you click and "login" with your login credentials.
    6. Presto, your credentials are now on the wild, and you have given the hackers a free pass to your T-Mobiel account, and posible financial information.
    So beware.
    Never click on embedded URLs within the body of emails.
  12. iapplelove macrumors 601


    Nov 22, 2011
    East Coast USA
    The equifax breach got you long ago. This is like the ice cream on the cake.
  13. Doctor Q Administrator

    Doctor Q

    Staff Member

    Sep 19, 2002
    Los Angeles
    Consumers who aren't customers of T-Mobile or MetroPCS may think "I'm glad it's not me," but security breaches happen so regularly that just about anyone with an online presence will be caught in one or more of them eventually, if they haven't already.
  14. spiddyman007 macrumors regular


    Jun 17, 2017
    Does it affect virtual carriers on T-Mobile like family mobile and straight talk?
  15. Macaholic868 macrumors 6502


    Feb 2, 2017
    At this point I simply assume that any and all electronic communications, records, etc. including all the files on my own computer are or will be compromised. Even those that are encrypted though I recognize those are safer than unencrypted files. The old saying “if you don’t want it read then don’t write it down” applies just as much today as it ever did in the past.

    If you truly have electronic data you want to keep safe keep it on a device with encryption that is never connected to a network of any kind.
  16. justperry macrumors G3


    Aug 10, 2007
    In the core of a black hole.
    That was some good advise in your post, but I have to disagree (mostly) with that last sentence.

    • What about an email you just got (from an online shop, government stuff amongst others.) to verify your identity.
    • Tracking information.
    • Url's from an advertisement you want to see.
    • URL's which show you your receipt at a store
    • ..... and so on...
    I just think you should at least check the URL, and never click URL's for financial stuff or very important stuff.

Share This Page