T-Mobile hacked again, data of 37 million customers compromised – Times of India

The calendar has changed, hacking incidents have not. Continuing their 2022 trend, hackers have stolen data of 37 million T-Mobile customers. This is the telecom giant’s second major cyberattack incident in less than two years.
In a securities filing, T-Mobile said that a hacker had collected data, including names, birth dates and phone numbers of 37 million consumers. The telco said it first discovered that a “bad actor” was obtaining the data on January 5. It plugged the breach with help from outside cybersecurity experts the next day.
The company also claimed that there was no evidence that its systems or network had been compromised. “We understand that an incident like this has an impact on our customers and regret that this occurred. Our investigation is still ongoing, but the malicious activity appears to be fully contained at this time,” T-Mobile said in a statement.

T-Mobile also said that the loophole the hacker exploited did not provide access to more sensitive information such as social security numbers, government identification numbers, or passwords or payment card information.
“The preliminary result from our investigation indicates that the bad actor(s) obtained data for approximately 37 million current postpaid and prepaid customer accounts, though many of these accounts did not include the full data set,” it said.
What caused data breach?
T-Mobile says that a threat actor was able to steal the personal information of its current postpaid and prepaid customers through one of its Application Programming Interfaces (APIs) – a software interface used by applications to communicate with each other.

T-Mobile did not delve into much information on how or what loophole in their API was exploited but did say that the attacker had access to customers’ information from around November 25, 2022.
“Rather, the impacted API is only able to provide a limited set of customer account data, including name, billing address, email, phone number, date of birth, T-Mobile account number and information such as the number of lines on the account and plan features,” T-Mobile said.
The carrier is now working with law enforcement to investigate the breach and is notifying customers who might have been targeted.