The T-Mobile Data Breach Is Much Worse Than It Had to Be

In an email overnight, T-Mobile shared details about the data breach it confirmed Monday afternoon. They’re not great. Assorted data from more than 48 million people was compromised, and while that’s less than the 100 million that the hacker had initially advertised, the vast majority of those affected turn out not to be current T-Mobile customers at all.

Instead, T-Mobile says that of the people whose data was compromised, more than 40 million are former or prospective customers who had applied for credit with the carrier. Another 7.8 million are current “postpaid” customers, which just means T-Mobile customers who get billed at the end of each month. Those roughly 48 million users had their full names, dates of birth, social security numbers, and driver’s license information stolen. An additional 850,000 prepaid customers—who fund their accounts in advance—had their names, phone numbers, and PINs exposed. The investigation is ongoing, which means that the tally may not stop there.

There’s no good news here, but the slightly less bad news is that the vast majority of customers appear not to have had their phone numbers, account numbers, PINs, passwords, or financial information taken in the breach. The bigger question, though, is whether T-Mobile really needed to hold on to such sensitive information from 40 million people with whom it doesn’t currently do businesses. Or if the company was going to stockpile that data, why it didn’t take better precautions to protect it.

“Generally speaking, it’s still the Wild West in the United States when it comes to the types of information companies can keep about us,” says Amy Keller, a partner at the law firm DiCello Levitt Gutzler who led the class action lawsuit against Equifax after the credit bureau’s 2017 breach. “I’m surprised and I’m also not surprised. I guess you could say I’m frustrated.”

Privacy advocates have long promoted the concept of data minimization, a fairly self-explanatory practice that encourages companies to hold on to as little information as necessary. Europe’s General Data Protection Regulation codifies the practice, requiring that personal data be “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.” The US currently has no equivalent on the books. “Privacy laws in the United States that do touch upon data minimization generally don’t require it,” Keller says, “and instead recommend it as a best practice.”

Until and unless the US adopts an omnibus privacy law similar to the GDPR—or state-level legislation like the California Consumer Privacy Act starts taking a harder line—data minimization will remain a foreign concept. “In general, collecting and retaining sensitive data of prospective and former customers is not an act of consumer fraud under US law, and is routine,” says David Opderbeck, codirector of Seton Hall University’s Institute of Law, Science and Technology. As inappropriate as it may seem for T-Mobile to keep detailed records on millions of people who may never have been their customers, there’s nothing stopping it from doing so, for as long as it likes.

Now those former and prospective customers, along with millions of current T-Mobile subscribers, find themselves victims of a data breach they had no control over. “The first risk is identity theft,” says John LaCour, founder and CTO of digital risk protection company PhishLabs. “The information includes names, social security numbers, driver’s license IDs: all the information that would be required to apply for credit as someone.”

The hack would also potentially make it easier to pull off so-called SIM swap attacks, LaCour says, particularly against the prepaid customers who had their PINs and phone numbers exposed. In a SIM swap, a hacker ports your number to their own device, typically so that they can intercept SMS-based two-factor authentication codes, making it easier to break into your online accounts. T-Mobile did not respond to an inquiry from WIRED as to whether International Mobile Equipment Identity numbers were also implicated in the breach; each mobile device has a unique IMEI that would also be of value to SIM-swappers.

T-Mobile has implemented a few precautions on behalf of victims. It’s offering two years of identity protection services from McAfee’s ID Theft Protection Service, and it has already reset the PINs of the 850,000 prepaid customers who had theirs exposed. It’s recommending but not mandating that all current postpaid customers change their PINs as well, and it is offering a service called Account Takeover Protection to help stymie SIM-swap attacks. It also plans to publish a site for “one-stop information” Wednesday, although the company didn’t say if it would offer any kind of lookup to see if you’re affected by the breach.

Source: The T-Mobile Data Breach Is Much Worse Than It Had to Be

*This is a free press release. Upgraded press releases are ad-free!

The stainless steel air distribution industry

When it comes to manufacturing air distribution components for sterile environments, there’s no room for error. And because perfection is required for long-lasting, functional HVAC components, the right material and manufacturing processes are important factors.For everything from stainless steel grilles to air diffusers to HEPA filtration systems, the stainless steel air distribution industry is vitally…

Read Press Release

NTD Expands Its Service in Washington and San Francisco

NTD, The Epoch Times’ sister media, has expanded its service in Washington by partnering with local TV station WJAL. NTD has also added a new 24/7 channel on Comcast in San Francisco. The new launch makes NTD available to nearly 4 million additional cable subscribers. NTD currently broadcasts 24/7 on WJAL’s primary channel 68.1. WJAL…

Read Press Release

100k SOLR tokens will be airdropped ahead of the IDO

SolRazr has been observed getting overwhelming support from its communitySolRazr’s whitelist for the first IDO is now liveAhead of the IDO and whitelisting the protocol will do an airdrop of 100k SOLR tokensSolRazr is the DeFi tool on the Solana blockchain network. It is the first decentralized developer ecosystem for Solna. Notably, the protocol offers…

Read Press Release

FBI Investigates Alleged Attack on Female Soldier by Male Afghan Refugees at New Mexico Base

Marines with Special Purpose Marine Air-Ground Task Force-Crisis Response-Central Command guide evacuees on to a U.S. Air Force C-17 Globemaster III during an evacuation at Hamid Karzai International Airport in Kabul, Afghanistan, August 21, 2021. (Sergeant Samuel Ruiz/U.S. Marine Corps) The FBI has launched an investigation into the alleged assault of a female soldier perpetrated…

Read Press Release

The T-Mobile Data Breach Is Much Worse Than It Had to Be - Click To Share

Share on facebook
Share on twitter
Share on reddit
Share on linkedin
Share on email
Share on whatsapp