“Around 37 million T-Mobile customers have had their personal data stolen after an 'unidentified malicious intruder' hacked the mobile giant's network - its second major security beach in just two years.

The company told the Security and Exchange Commission the breach was discovered on January 5 and said the data stolen included customers' addresses, phone numbers and dates of birth.

Based on its investigation to date, the breach did not expose passwords, Pins, bank account or credit card details, Social Security numbers or other government IDs.

The firm said it had notified law enforcement and federal agencies, stating the data was first accessed on or around November 25.
……

'Our investigation is still ongoing, but the malicious activity appears to be fully contained at this time, and there is currently no evidence that the bad actor was able to breach or compromise our systems or our network,' the company said, adding it had begun notifying impacted customers. …”

[I haven’t been notified … so far…]

https://mol.im/a/11656571

Same here no notice yet...

I believe this would be the third major breach in recent history.

I like TMO as a wireless carrier, but, this is appalling.

I've been receiving text messages from T-Mobile about new promotions to reduce my monthly charges. I replied and almost fell for their scam. The scammers used the same text address, 456, as T-Mobile. Beware.

This is why I give out as little info as possible. Why does a cell service need your DOB?
I remember in very old days Bell would only need an name and address.

People really need to be held criminally liable and accountable each time this occurs.

It seems to me that- as weird as it sounds- the size of the breach is the only protection we have. If the thieves had managed to steal, say 2000 names, then the odds are very good that a customer is going to have a problem, but 37 million?

quote:

Originally posted by TRIO:
This is why I give out as little info as possible. Why does a cell service need your DOB?
I remember in very old days Bell would only need an name and address.

I've had cell service through Verizon and ATT and nobody ever asked me for a birthdate.

quote:

Originally posted by parabellum:
It seems to me that- as weird as it sounds- the size of the breach is the only protection we have. If the thieves had managed to steal, say 2000 names, then the odds are very good that a customer is going to have a problem, but 37 million?

"Lost in the noise" is not regarded as an effective security measure. It may well be that the perpetrators of the breach intend to sell the data to others to exploit, perhaps in blocks of no more than 2,000 names per transaction.

I've been spending a lot of time in various medical provider's vicinities lately, it is almost universal that the DoB is used as an identity confirmation, knowing name+DoB is enough to gain access to medical records, etc. in most cases.

I haven't received any notice for this or the last one from T-Mobile. I only heard about the hack from this thread.

Maybe I should be more pissed off about this, but I am just worn out from living in a post-privacy civilization for so long.
Had to go to the "local" IRS office a few years back to straighten out my identity because a former employer got hacked. Big pain in the ass that was totally out of my control.

Lie whenever possible about as much as you can when signing up, keep several silos of emails, use a good password manager and two-factor authorization. That's life now.

quote:

Originally posted by Rey HRH:
I haven't received any notice for this or the last one from T-Mobile. I only heard about the hack from this thread.

Nor did I, I called T-Mobile customer service yesterday when I suspected the scam even though the scammer knew my monthly payment to the penny. CS told me there were no promotions for reduced billing, CS didn't say there was a data breach.

quote:

Originally posted by parabellum:
If the thieves had managed to steal, say 2000 names, then the odds are very good that a customer is going to have a problem, but 37 million?

That comes out to be 1 customer for every scam artist in India.

I just tried to login to T Mobile's site and the site works but login appears to be down.
'Service Unavailable.
'F451 : Uh-oh, it looks like we have our wires crossed. Please try again later.' it says. I tried it 3x.

quote:

Originally posted by parabellum:
It seems to me that- as weird as it sounds- the size of the breach is the only protection we have. If the thieves had managed to steal, say 2000 names, then the odds are very good that a customer is going to have a problem, but 37 million?

I’m not an expert in this field, but I don’t think the volume matters anymore. In the most benign manner, these are sold as lists on the black market.

Black hats just run bots/programs against the lists.

Of course you could run some quick analytics on the data and come up with smarter/refined target lists.

I’m sure this stuff gets used in ways I’ve never even dreamed of.

quote:

Originally posted by SIGnified:

quote:

Originally posted by parabellum:
It seems to me that- as weird as it sounds- the size of the breach is the only protection we have. If the thieves had managed to steal, say 2000 names, then the odds are very good that a customer is going to have a problem, but 37 million?

I’m not an expert in this field, but I don’t think the volume matters anymore. In the most benign manner, these are sold as lists on the black market.

Black hats just run bots/programs against the lists.

Of course you could run some quick analytics on the data and come up with smarter/refined target lists.

I’m sure this stuff gets used in ways I’ve never even dreamed of.

I agree.
Anyone sophisticated enough to hack T-Mobile could certainly automate the processing of this information.
I suspect many of these data breaches come from insider information. We can thank the geniuses responsible for outsourcing our IT for this.