14 ms·
T-Mobile investigating claims of 100M customer data breach
- jondwillis 5y agolow quality post: can’t wait for my two free years of Experian.
- xyst 5y agobeen associated with so many data breaches, my Experian account is free for life
- contingencies 5y agoT-Mobile runs billing on https://en.wikipedia.org/wiki/Amdocs https://en.wikipedia.org/wiki/Amdocs
- swiley 5y agoOh neat, isn't that the parent to the company running Matrix? (for anyone that freaked out, you should have been using XMPP.)
- karmanyaahm 5y agonot currently parent afaik. Just historically started there.
- dane-pgp 5y agoActually they are the parent of the company which used to employ the Matrix team, before that team created their own company "New Vector Limited" in 2017 (after the money from Amdocs ran out). https://en.wikipedia.org/wiki/Matrix_%28protocol%29#History https://en.wikipedia.org/wiki/Matrix_%28protocol%29#History
- malwarebytess 5y agoAs opposed to the intentional breach earlier this year that they gave customers only one month to opt-out of? https://fortune.com/2021/03/09/t-mobile-sprint-metro-data-privacy-advertisers-opt-out/ https://fortune.com/2021/03/09/t-mobile-sprint-metro-data-pr...
- Jxl180 5y agoI fail to see how that would be classified as a breach.
- DominoTree 5y agoA breach of trust, perhaps
- yjftsjthsd-h 5y agoFrom the customer's perspective, does it matter how their data got out?
- rafale 5y agoGot my t-mobile SIM hijacked and the hackers changed my email, then tried to get access to my Coinbase account. Thank god I was using a 2FA app for the latter. To this day I don't know how the hackers did it. Thru social engineering on phone? In person at an agency with fake id? Or a corrupt insider working at T-mobile. This happened after the Ledger hack. My SSN was also leaked in the Equifax hack. This experience made me realize how much of a joke the concept of "identity" is in our society. It can be bought and stolen like any asset.
- arkadiyt 5y agoMost carriers, including T-Mobile, support a "NOPORT" feature to disallow porting your phone number: https://www.vice.com/en/article/ywa3dv/t-mobile-has-a-secret-setting-to-protect-your-account-from-hackers-that-it-refuses-to-talk-about https://www.vice.com/en/article/ywa3dv/t-mobile-has-a-secret...
- toast0 5y agoI can't figure out how to get these enabled for prepaid accounts (t-mobile and verizon). And I'm not going to switch to post paid for 2-3x the cost just for this. I'm already paying extra to use carrier prepaid instead of an MVNO.
- deleted 5y ago[deleted]
- netsec_burn 5y agoWhen you say most carriers, which ones are you specifically referring to?
- rafale 5y agoAll of them practically. I think at the beginning the feature was mostly used for celebrities and public figures. But I think it should become the default. The main reason it's not, in my understanding, is because of a federal telecom law that states it should be easy to transfer phone numbers across providers.
- arboghast 5y agoDoesn’t surprise me considering their POS systems have regular users (employees) as local admins.
- koolba 5y agoDoes POS refer to “point of sale” of “piece of shit”?
- kQq9oHeAz6wLLS 5y agoBoth, apparently.
- yjftsjthsd-h 5y agoIt officially refers to point of sale, but I'm reliably informed by everybody who has ever touched these things that both acronyms apply.
- Operyl 5y agoAt least in my area, they appear to use iPads exclusively now with some web app.
- cascom 5y agoI feel like companies like this should have to register a data breach like this in a national register, and then should someone become a victim of identity theft, the companies on that register associated with that person should bear the costs associated with that theft (importantly without the victim having to show that it was a direct result of that breach). E.g. John Smith ss#123-45-6789 (T-mobile, Experian) has a false refund filed in his name, $10k in legal costs associated with clearing his name, t-mobile and experian each owe him $5k… Until companies are held accountable for the negative externalities they are causing, this won’t end.
- slg 5y agoPlus money for the wasted time and stress this causes. Often people won’t be responsible for huge financial outlays once these issues are resolved, but it can take countless hours and an unmeasurable about of stress to get there.
- dheera 5y agoYes this. Every hour on the phone is an hour less salary for many people.
- maxerickson 5y agoYou shouldn't become a victim when a bank opens a fraudulent account. The law shouldn't be that someone else has to pay the costs, the law should be that you tell them to prove it was you that acted to open an account and they go pound sand if they can't do that.
- jjeaff 5y agoI agree. Surely there are cases where people have sued the bank or whatever provider for opening an account in their name. It seems like I should just be able to send them a certified letter that says no, i didn't open that account, please close and correct your credit reporting unless you have proof otherwise. If you don't comply I'll see you in my nearest small claim court. Seems like it would be an open and shut case.
- caconym_ 5y agoThe data from the Equifax breach, as bad as that breach was (and as criminally derelict in its duties our government was in extracting meaningful accountability from them) does not seem to have made it onto the black market. If they're already selling the data, this one could be a lot worse in practice.
- cascom 5y agoI thought was supposed to have been a state actor…
- supertrope 5y agoIt would appear so since who else but a government would refrain from cashing out?
- ummonk 5y agoIs there any evidence this isn't a scam? Surely if it were real, the purported hacker would have already publshed a subsample to prove it?
- rahidz 5y ago>Motherboard has seen samples of the data, and confirmed they contained accurate information on T-Mobile customers. https://www.vice.com/en/article/akg8wg/tmobile-investigating-customer-data-breach-100-million https://www.vice.com/en/article/akg8wg/tmobile-investigating...
- aaron695 5y agoAsk them, contact details here - https://raidforums.com/User-SubVirt https://raidforums.com/User-SubVirt Also selling 833M China Phone Database IMSI, IMEI, MSISDN
- deleted 5y ago[deleted]
- swiley 5y agoRequiring a license to run LTE base stations is a disaster. Zero of the carriers are managing their infrastructure in any way resembling competence and responsibility and most of them probably couldn't even tell you how bad it is because they don't know and don't even have shells on their own equipment.
- 310260 5y agoDefine license. Do you mean spectrum license or something like Ericsson's feature licensing system?
- blagie 5y agoT-Mobile has no data security. I ran into a security breach there once. I reported it. It didn't get taken seriously. I did access the bills of several random T-Mobile customers, by accident, through what appeared to be a half-dozen related gaping holes. On the other hand, they have super-friendly customer service and they don't cheat.
- cs702 5y agoIn case you're wondering, "investigating" means "s#*t, we got hacked!" 100M customers. That's roughly one customer per US household. At this point, we should assume that our names, birth dates, home addresses, social security numbers, phone numbers, and account numbers are public information. We should probably also assume that many if not most of our passwords have been widely disseminated too. Life in the 21st century, argh.
- paulddraper 5y ago> names, home addresses, phone numbers These were already overwhelmingly public. Used to be distributed via phone books.
- p49k 5y agoYou could opt out of the phone book. Can't opt out of a data breach.
- paulddraper 5y agoYes, that's the "overwhelmingly" qualifier.
- system2 5y agoNot with your social security attached to it.
- SilverRed 5y ago2FA was probably the most important improvement to security in a long time. It seems to be the only thing that kept attackers out when everything else has been exposed.
- judge2020 5y agoThis only helps for credential stuffing attacks that use passwords from other database leaks, though - chances are the 2fa shared secrets are on the same row as the user's (maybe clear text[0]) password and can be easily used to get in despite 2fa. 0: https://www.pcmag.com/news/t-mobile-austria-is-ok-with-storing-passwords-partly-in-clear-text https://www.pcmag.com/news/t-mobile-austria-is-ok-with-stori...
- de6u99er 5y agoA couple of weeks ago I was receiving someone else's T-Systems internet contract and personal data via email. The customer was from Munich. I live in The Netherlands. I was more than 10 years ago customer of T-Mobile Austria. I immediately informed T-Systrms via their crappy contact form on their crappy website. After a couple of days I received an e-mail which I could not reply to, asking me to provide more proof that I was receiving someone else's emails through. It also said I can't reply directly to the email and I had to provide this info via their crappy contact form on their crappy website. I refused to do so, since I had already given them the name, address, and customer id of their new customer and it seemed that the procedure is going to be unnecesarily time consuming. After that I received emails about tracking of a package containing the hardware for the internet connection. Then I received an email that nobody was home to pick up the delivery and when the next attempt will be. UAnd utimately that the package was going to ve returned. After that I guess the customer got in touch with T-Systems and fixed the email error. Nobody from T-Systems contacted me asking to destroy the documents and emails containing someone else's personal data.
- drewg123 5y agoThis happens to me all the time, as have my lastname @gmail.com, and my name is not as unique as I thought. I typically contact the real person via some other information leaked in the email. I once had a lady accuse me of cyber-stalking her, since I texted her when I started getting her Verizon internet information (bills, shipping info for equipment, etc). I finally managed to explain to her that she'd given them the wrong email.
- jschwartzi 5y agoMy wife worked selling cell phones for a while. Apparently there are a huge number of older people who don’t understand that just because they put the email on the form that doesn’t mean they own the email address.
- sen 5y agoIt's not just old people, many people who aren't techies think that entering an email address into a Telco form means they're ASKING for that email address. I get multiple emails per day for all sorts of services from all over the world because I was an early Gmail user with a short account name. Most are people signing up to new phone/internet/etc services and they have my name as their first or last name.
- betwixthewires 5y agoAnd here it is, the 100% iron clad argument as to why you shouldn't have to give all sorts of personal information to get a phone number.
- supertrope 5y agoKYC strikes again. The United States is not quite as bad as other countries that require national ID to buy a SIM.
- meowster 5y agoYou don't have to, but people don't know any better. In the U.S., you can get a prepaid number without giving out your real name.
- betwixthewires 5y agoIn the US, yes, and it depends on what company you use. Like a lot of things in the US, people live by rules that are created by multinationals. It really doesn't matter which entity requires identity documents for a phone number, it is a bad idea in general.
- anonymousiam 5y agoIf you're a T-Mobile customer, chances are you data was already "leaked" because they recently changed their ToS and are selling customer information anyway. https://fortune.com/2021/03/09/t-mobile-sprint-metro-data-privacy-advertisers-opt-out/ https://fortune.com/2021/03/09/t-mobile-sprint-metro-data-pr...
- steviedotboston 5y agothey aren't selling peoples SSNs and credit card numbers ....
- jonathanmayer 5y agoT-Mobile has had recurring data security deficiencies. I know because I served as CTO of the FCC's Enforcement Bureau, before returning to academia. In 2017, the FCC determined that T-Mobile had violated federal law in a data breach involving customer credit information [1]. There was reportedly no fine because Congress has imposed a strict one-year statute of limitations on FCC enforcement actions. In 2020, the FCC charged T-Mobile with again violating federal law in failing to protect customer location information [2]. The FCC proposed a $91.6M fine, widely criticized as insufficient at the time [3-4]. I don't believe the FCC has finalized or collected that penalty. There have been several other incidents, including in 2018 [5], 2019 [6], early 2020 [7], and late 2020 [8]. I hope there has not been a new data breach. But if there has been, this is the latest in a pattern, and the incentives have to change. [1] https://www.nexttv.com/news/fcc-admonishes-t-mobile-breach-162602 https://www.nexttv.com/news/fcc-admonishes-t-mobile-breach-1... [2] https://www.fcc.gov/document/fcc-proposes-916m-fine-against-t-mobile-location-information-case https://www.fcc.gov/document/fcc-proposes-916m-fine-against-... [3] https://docs.fcc.gov/public/attachments/FCC-20-27A4.pdf https://docs.fcc.gov/public/attachments/FCC-20-27A4.pdf [4] https://docs.fcc.gov/public/attachments/FCC-20-27A5.pdf https://docs.fcc.gov/public/attachments/FCC-20-27A5.pdf [5] https://www.theverge.com/2018/8/24/17776836/tmobile-hack-data-breach-personal-information-two-million-customers https://www.theverge.com/2018/8/24/17776836/tmobile-hack-dat... [6] https://www.bleepingcomputer.com/news/security/t-mobile-discloses-data-breach-impacting-prepaid-customers/ https://www.bleepingcomputer.com/news/security/t-mobile-disc... [7] https://www.bleepingcomputer.com/news/security/t-mobile-data-breach-exposes-customer-personal-financial-info/ https://www.bleepingcomputer.com/news/security/t-mobile-data... [8] https://www.bleepingcomputer.com/news/security/t-mobile-data-breach-exposed-phone-numbers-call-records/ https://www.bleepingcomputer.com/news/security/t-mobile-data...
- studentrob 5y agoThank you for that context. It seems like breaches are happening every month now. What do you think needs to happen to ensure these gigantic companies secure data? I can imagine (a) new legislation enabling bigger, swifter fines or (b) anti-trust action. Do you think we should prioritize one over the other, do both, or something else?
- 5y ago
- hikerclimber1 5y agoOh no
- meowster 5y agoI would love to pay a cell phone company that takes data privacy and security seriously. There are similar companies for high-value domain names, why not phone numbers?
- meowster 5y agoLooks like Librem's AweSIM might fill this niche (at least in regards to privacy). They don't say how they protect your number though, and it's expensive, and doesn't even include SMS, just text(?).
- mensetmanusman 5y agoWe got the t-mobile SIM card to replace our sprint SIM last month (acquisition). We didn’t know it came with a 10x increase in spam calls (same number too, wtf?)
- xyst 5y agowhy is t-mobile storing social security numbers? this should only be necessary for new accounts and then immediately purged from their databases. Absolutely no reason for a telco to have this stored.
- fridif 5y agoAll telcos have to store SSNs, because most accounts are "postpaid" aka billed on the social credit of a customer. When you open a phone contract, they run your credit via SSN. Just another dumb way corps do things.
- lupire 5y agoNone of that is a reason to permanently retain the SSN.
- fridif 5y agoI completely agree, just merely telling you what they think the justification is.
- meowster 5y agoI agree. However a comment in another thread explained they would need the SSN to make a report with the credit bureau if you missed payments. That's an easy fix in my opinion: The SSN should be used for read-only. Once the credit report is read/accessed, the credit bureau issues a write-only code. The company then deletes the SSN and only retains the write-only code. If the write-only code is leaked later in a hack, it is useless to criminals trying to open new accounts.
- astura 5y agoIf they don't pay the bill/pay off the financed phone then TMobile will attempt to collect, sell the account off to collections, and report the account as delinquent to the credit bureaus. Having the customers SSN is basically required for those activities. A post paid phone plan is a revolving line of credit - just like a credit card.
- markstos 5y agoThree months ago I posted: "T-Mobile customer portal full of unnecessary trackers is a security risk". Commenters familiar with some of the trackers clarified some third parties could live record user sessions. https://www.reddit.com/r/tmobile/comments/n9xfok/tmobile_customer_portal_full_of_unnecessary/ https://www.reddit.com/r/tmobile/comments/n9xfok/tmobile_cus...
- grae_QED 5y agoMore evidence to support my belief that everyone should just opt out of providing their identities whenever possible. Some people might call it fraud but things that occur on the internet isn't real life anyways. Why should I blend the two? Though to be fair, whenever If I think I might get into trouble for not providing my real name I just use my initials.
- meowster 5y agoThat, and companies shouldn't hold on to information they don't need. I never give doctor offices my SSN or other extra information, and they never batt an eye. People are just conditioned that if they're asked for something, they have to give it.
- fridif 5y agoUsed to work at T-Mobile. It was a complete and utter shit show and I'm extremely glad I left. Mega corps never do things well.
- josh_today 5y agoIf corporations have challenges keeping private data private, data should belong to the individual. If corporations ”own” private data, they should be held liable for breaches.
- mplewis 5y agoT-Mobile does not take security seriously. I once encountered the infamous JWT alg: none bug in a series of codebases I worked on at T-Mobile. I built a PoC exploit that demonstrated complete bypass of all JWT user authN, publicized it to my team, and escalated it to my manager and later my skip level. The bug was never fixed and my attempts to ship a fix were never prioritized. I am only comfortable stating this now because the affected codebases are no longer in use.
- QuadrupleA 5y agoRansom payments and the incentivization of destructive hacking: one more of cryptocurrency's great contributions to the world.
- 3r8Oltr0ziouVDM 5y agoInstead of crying about cryptocurrencies, we should focus on making our systems more secure.
- QuadrupleA 5y agoComments to help hasten the popping of the crypto bubble are good for the world I think - but yeah, we should make our systems more secure too.
- shrimpx 5y agoHow does T-Mobile get SSN and Driver License info from its customers? I use a T-Mobile SIM card and I never gave them anything that private.
- cestith 5y agoProbably from people financing phones. Most credit applications require information like that in the US.
- jabroni_salad 5y agoAre you on pre-paid? It is usually only post-paid plans that require identity.
- shrimpx 5y agoYeah I’m on prepaid. Good point.
- jamal-kumar 5y agoShit like this is why I go to extraordinary links to keep my cell phone unlinked from my identity. This is honestly harder on people who complain about having to change my contact once every 6 months or so (I travel a lot, and a prepaid won't make it from one country to another) but if that's the only suffering that has to happen in order to completely avoid scenarios like this, or someone doing a SIM swapping attack on me, then so be it.
- arbuge 5y agoLots of these comments are pointing out the lack of security at T-Mobile. For somebody looking to change from T-Mobile because of that reason, which, if any, of the US carriers are known to take security seriously?
- shbooms 5y agowhat should be done if you end up being on this list (which supposedly includes SS#'s)
- frakt0x90 5y agoA lot of comments about how terrible T-mobile security is. Is there a (US) carrier that has good security? How much worse is it than others?
- deleted 5y ago[deleted]
- skarz 5y agoThat's going to be a lot of cloned mobiles and SMS 2FA account takeovers. It's going to be very difficult rotating out that information. That treasure trove of data is worth a lot and somebody is going to pay for it. This KYC and handing over personal information should be replaced with zero knowledge proofs and everything encrypted. Companies should be data audited and fined for not encrypting and logging and minimising data access and minimising data and only keeping relevant data. In fact the state requiring companies to keep data long term also puts you at risk, data should be minimsed not only in content but in time.
- BrianBartA 5y agoCISO shoud resign and CEO should be put in jail. Plus $50B fine would light a fire under them and others.
- BrianBartA 5y agoCISO and CeO should be put in jail. Plus a $50B fine should light a fire under slackers