Personal customer information exposed in T-Mobile system glitch

Telecommunications company T-Mobile has been accused of two data breaches – one caused by a “system glitch” that accidentally exposed the personal information of its customers and the other that allegedly exposed employee personal information.

The data breach was recognized by customers on September 20, who noticed that, upon logging into the T-Mobile app, that other customer’s information was being displayed instead of their own. This meant that personally identifying information including address, credit card information and purchase history was exposed. Those affected took to social media sites to post about the cyber security incident.

T-Mobile addressed the data breach, telling news site The Register that the cyber security incident affected less than 100 customers and was “quickly resolved”.

“There was no cyber attack or breach at T-Mobile. This was a temporary system glitch related to a planned overnight technology update involving limited account information for fewer than 100 customers,” a spokesperson explained to The Register.

While less than 100 customers’ data was impacted by the glitch, it has not been made public how many people their data was exposed to.

On September 22, vx underground, which refers to itself as “the largest collection of malware source code, samples, and papers on the internet”, posted allegations that T-Mobile had suffered a data breach in April of this year, which saw 90GB of employee’s personal data stolen. It was later clarified that the data breach impacted an independtly owned authorized T-Mobile retailer.

The leak was shared to infamous dark web hacking forum, BreachForum on September 21. Data stolen in the cyber attack allegedly included employee’s full names, job titles, social security numbers and email addresses, among other data.

Hello, prepare yourself for another long post about the new T-Mobile breach and a mistake that we made.

Mistake: Employee PII was leaked, NOT customer PII. This is the 2nd time a T-Mobile breach has exposed T-Mobile employees.

We've had a large number of people asking how we… pic.twitter.com/w5YdHNkBaO

— vx-underground (@vxunderground) September 22, 2023

T-Mobile addressed the breach, saying that it was a T-Mobile franchise, rather than T-Mobile corporate, which was the victim of a breach. According to the telecommunications company, the data breach was disclosed in court on May 10 of this year and affected 17,835 past and present employees.

Using this information, it has been suggested that independently owned T-Mobile dealer, Connectivity Source, was the victim of the data breach.