This suggests T-Mobile's defenses do not utilize modern security monitoring and threat hunting teams, as you might expect to find in a large enterprise like a mobile network operator.”īecause of limits on the API (an interface that facilitates communication between two software programs), the attacker did not gain access to Social Security numbers or tax IDs, driver's license data, passwords and PINs, or financial information like payment card data. “It is also concerning that the criminals were in T-Mobile's system for more than a month before being discovered. “I'm certainly disappointed to hear that, after as many breaches as they've had, they still haven't been able to shore up their leaky ship,” says Chester Wisniewski, field chief technical officer of applied research at the security firm Sophos. Most large companies struggle with digital security, and no one is immune to data breaches, but T-Mobile seems to be approaching companies like Yahoo in the pantheon of repeated compromises. The company had a mega breach in 2021, two breaches in 2020, one in 2019, and another in 2018. But in the past 10 years, the company has developed a reputation for suffering repeated data breaches alongside other security incidents. T-Mobile is one of the US's largest mobile carriers and is estimated to have more than 100 million customers.
