T-Mobile has confirmed that a major data breach has compromised the personal information of approximately 47.8 million people, including current postpaid customers, prepaid customers, and former or prospective customers who had once applied for credit with the company. As your resident consumer watchdog, dedicated to flagging scams, recalls and bad deals before they cause real harm, this is exactly the kind of breach worth paying close attention to, since the stolen data can fuel identity theft and phishing schemes for years to come.
According to T-Mobile, about 7.8 million current postpaid customer records were stolen, along with just over 40 million records belonging to former or prospective customers who had previously applied for credit with the company. The breach is smaller than the 100 million records initially reported by Vice, but it remains one of the largest in T-Mobile's history. The company reportedly only shut down the leak after learning about it through an online forum.
How to spot it
- Stolen data reportedly includes first and last names, dates of birth, Social Security numbers, and driver's license or ID information.
- For postpaid accounts and former or prospective customers, T-Mobile says no phone numbers, account numbers, PINs, passwords, or financial information were compromised.
- For 850,000 active T-Mobile prepaid customers, the damage is worse: phone numbers and account PINs were also exposed.
- Metro by T-Mobile, former Sprint prepaid, and Boost customers reportedly did not have their names or PINs exposed in this breach.
What to do if it happened to you
T-Mobile says it is taking immediate action to protect affected customers. The company is offering two years of free identity protection through McAfee's ID Theft Protection Service. It is recommending that all postpaid customers change their PINs, and it is offering extra protection through its Account Takeover Protection feature for postpaid accounts. For the 850,000 affected prepaid customers, T-Mobile says it has already reset their PINs and will be notifying them directly. The company has also published a web page with information related to the breach.
While no financial information or passwords appear to have been compromised, the exposure of Social Security numbers and ID information still leaves millions vulnerable to identity theft and phishing attempts. This is far from T-Mobile's first security lapse. The company has reported breaches in 2018, 2019, 2020, and earlier in 2021, though this latest incident ranks among the worst yet.
Source: Mashable
