T-Mobile Confirms "Unauthorized Access"

What We Know So Far:

• On August 15, Vice reported that T-Mobile was investigating claims that someone obtained the personal data of 100+ million people from its servers.
• The stolen data was being sold on a dark web forum and purportedly contains “social security numbers, phone numbers, names, physical addresses, unique IMEI numbers, and driver licenses information”
• On August 16, T-Mobile confirmed that “unauthorized access” occurred, but they have not yet confirmed if any personal customer data was involved.
• T-Mobile says the unauthorized entry point “has been closed” and T-Mobile is continuing its investigation to determine what was accessed.
• On August 17, T-Mobile released another statement confirming that the stolen data included the first and last names, date of birth, SSN, and driver’s license/ID information of approximately 47.8 million current and former customers. T-Mobile claims that no phone numbers, account numbers, PINs, passwords, or financial information were compromised.
• T-Mobile will send communication to all affected individuals offering 2 years of identity protection services. T-Mobile recommends that all postpaid customers change their PIN and consider taking advantage of their Account Takeover Protection.
• On August 20, T-Mobile released an update stating that they have identified another 5.3 million current customer accounts were compromised. They also confirmed that phone numbers, IMEI and IMSI information were compromised.
• On August 27, T-Mobile CEO Mike Sievert published a blog post summarizing the incident, stating the cyberattacker's "intent was to break in and steal data, and they succeeded." He stated that T-Mobile is notifying all current, former and prospective customers, and linked their web page offering recommended next steps.

We will continue to provide updates here.

Recommendations:

If you’re concerned that your data may have been compromised in the T-Mobile breach, we recommend the following security measures:

• Use secure passwords with multi-factor authentication.
• Maximize your email security to avoid getting phished.
• Set up alerts with our Compromised Credential Monitoring so that you are notified the minute your information does appear on the Dark Web.

AllSafe IT’s Safe Total is a multi-layered security solution that provides these safeguards and more.

‍