BELLEVUE, Wash. — Wireless carrier T-Mobile has confirmed that “unauthorized individuals” gained access to personal data tied to millions of customer accounts in a recent cyberattack.
In a news release Wednesday, the company said a preliminary investigation found that the stolen files include information from 7.8 million postpaid customer accounts, “as well as just over 40 million records of former or prospective customers who had previously applied for credit” with the carrier.
“We have no indication that the data contained in the stolen files included any customer financial information, credit card information, debit or other payment information,” the company said in the release. “Some of the data accessed did include customers’ first and last names, date of birth, [Social Security number] and driver’s license/ID information for a subset of current and former postpay customers and prospective T-Mobile customers.”
Additionally, the names, phone numbers and account PINs of about 850,000 current prepaid customers were exposed in the breach, the company said.
“We have already proactively reset ALL of the PINs on these accounts to help protect these customers, and we will be notifying accordingly right away,” the company said. “No Metro by T-Mobile, former Sprint prepaid or Boost customers had their names or PINs exposed.”
The breach also included billing files for some inactive prepaid accounts, but the data did not include any financial information or Social Security numbers, the company said.
T-Mobile is offering two years of McAfee’s ID Theft Protection Service to those whose data may have been compromised, according to the release. The carrier went on to recommend that postpaid customers change their PINs as a precaution.
The update came three days after Vice’s Motherboard reported that an online forum user claimed to have massive amounts of personal data to sell. The seller told Vice that the data, which includes information tied to more than 100 million people, was obtained by accessing T-Mobile’s servers.
On Monday, the carrier confirmed it had launched an investigation into the incident, adding that “the entry point used to gain access has been closed.”
“We have been working around the clock to investigate claims being made that T-Mobile data may have been illegally accessed,” the company said in a news release Monday. “We take the protection of our customers very seriously and we are conducting an extensive analysis alongside digital forensic experts to understand the validity of these claims, and we are coordinating with law enforcement.”
– The Associated Press contributed to this report.
©2021 Cox Media Group
/cloudfront-us-east-1.images.arcpublishing.com/cmg/7QOJU3BNCJERBNKJC5LWTBYFLU.png)
