Telecommunications provider T-Mobile is the latest high-profile company experiencing fallout from a massive security breach resulting in stolen personal data of more than 50 million users.
On Tuesday, August 17th, hackers gained access to current, previous, and potential T-Mobile customers’ social security and driver’s license numbers, birth dates, PIN codes and more. Most of the stolen information came from people who provided social security and driver’s license information for credit checks in order to open a T-Mobile account.
According to Motherboard, T-Mobile was notified of the breach after the hackers basically posted a “for sale” sign in a dark web forum asking for six bitcoins ($270,000) in exchange for 30 million social security and driver’s license numbers. More stolen information was to be negotiated privately.
In an announcement on Wednesday, T-Mobile stated that, “Late last week, we were informed of claims made in an online forum that a bad actor had compromised T-Mobile systems,” and that the company “immediately began an exhaustive investigation into these claims and brought in world-leading cybersecurity experts to help with our assessment.” The press release went on to state that the company had located and closed the access point on its server where the breach occurred and that they are coordinating with law enforcement in an ongoing forensic investigation.
In addition to trying to figure out how the breach occurred, T-Mobile is also having to deal with a pair of class-action lawsuits that have already been filed against the company. Both suits, Espanoza v. T-Mobile USA and Durwalla v. T-Mobile USA, were filed on Thursday, August 19th and charge the company with negligence and failure to protect customers by failing to implement adequate security procedures.
T-Mobile has been offering advice to customers who might be affected by the breach as to how to protect their personal information going forward and is providing McAfee ID Theft Protection Service free for two years. The company found no indication that any personal financial, payment, credit or debit card information, account numbers or passwords were accessed in the breach.
This latest security breach is the fifth T-Mobile has experienced in the last three years, with previous attacks happening in August 2018, November 2019, and two last year in March and December. Allie Mellen of Forrester Research called this recent incident “the worst.”
“T-Mobile is offering two free years of identity protection for affected customers,” Mellen said. “But ultimately this is pushing the responsibility for the safety of the data onto the user. Instead of addressing the security gaps that have plagued T-Mobile for years, they are offering their customers temporary identity protection when breaches happen, as if to say this is the best we can do.”
Want to defend against breaches?
You can use Critical Insight’s Continuous Vulnerability Scanning to look for needed patches and issues. Then, pair it with Critical Insight Managed Detection and Response to catch the bad actors if they get in. Contact us today!