19 ms·

T-Mobile Confirms It Was Hacked

432 points by jbegley 5y ago

polka_haunts_us 5y ago
I had 5 spam calls this morning from various suspicious phone numbers, including one from Europe. That's more than I've gotten since I first got this phone number total. I guess it's unreasonable to expect the good times to last like that but man, I'm still deeply unhappy with T-Mobile right now.
- samstave 5y ago
  I get numbers from EU as well -- and I get some at ~3AM PST as well...
- dheera 5y ago
  I get about 10+ spam calls a day, I just block all calls except for a couple of whitelisted numbers, and forward the rest to something that plays a hold song endlessly.
  - ARandomerDude 5y ago
    In before a 20yo culture warrior says "allowlist."
  - capitainenemo 5y ago
    Sometimes I get calls from people I forget to whitelist or who might actually be important (workmen for example). So, I have my default phone ringtone set to a 0.1s, 200 byte mp3 of silence. Anyone in my address book gets my standard address book ringtone. Then I just check the emails of the voicemails once a day.
- abawany 5y ago
  Google Voice (GV) and Voip.ms have fairly sophisticated screening that tends to get the 'vehicle warranty' bots to hang up quickly. I wish our phone carriers offered such methods to ensure that their 'services' remain relevant in an increasingly spammy world. Edit: for GV, you will need to enable screening by going to https://voice.google.com/u/0/settings https://voice.google.com/u/0/settings and setting "Screen calls" and for Voip.ms, you will need to setup a IVR so that callers have to enter in a code before they are allowed through.
  - dopamean 5y ago
    I've been using google voice for 7+ years and I get a TON of those vehicle warranty calls. At least one almost every day.
    - abawany 5y ago
      You need to enable screening by going to https://voice.google.com/u/0/settings https://voice.google.com/u/0/settings .
      - mfkp 5y ago
        I've got screening enabled and still get at least 3 spam calls per day, usually more.
        abawany 5y ago
        I am surprised - they are ringing your phone/the app vs. just ending up as 'missed calls'? I presume you are also marking them as spam to prevent recurrence and that these numbers are not in your contacts? (Not being sarcastic, just trying to help.)
        mfkp 5y ago
        Yes, it rings my phone. Most are annoyingly early in the morning, and 90% of the time it comes from random numbers in the same area code as my phone number. I haven't been marking the numbers as spam, but maybe I'll try to do that to see if the number of calls reduces.
        abawany 5y ago
        One more thing to check: in the Legacy GV webapp (google.com/voice/b/0/redirection/voice) in the Groups tab, the Screening is On for anonymous callers in addition to the original place that I listed above? Hopefully marking as spam will help too. One thing I like about Voip.ms vs. GV is that in the former, I can mass block an entire range of number using wildcards, which is rather satisfying especially since I setup the rules to ring as busy vs. just hanging up to keep their systems online a bit longer vs. freeing them to disrupt their next victim.
- S_A_P 5y ago
  Don't feel bad- Im on AT&T and Ive noticed a HUGE uptick in spam sms messages. Pretty sure my number was leaked in some breach.
  - judge2020 5y ago
    For what it's worth I've continued to report these to both AT&T[0] and Safe Browsing[1]. 0: https://www.att.com/support/article/my-account/KM1051831/#:~:text=Alert%20AT%26T%20by%20forwarding%20the%20suspicious%20text%20to%207726%20on%20your%20device https://www.att.com/support/article/my-account/KM1051831/#:~.... 1: https://safebrowsing.google.com/safebrowsing/report_general/ https://safebrowsing.google.com/safebrowsing/report_general/
  - gruez 5y ago
    >Pretty sure my number was leaked in some breach. Why do spammers need leaked phone numbers? Can't they just call/message every number?
    - easrng 5y ago
      They can and do, but it's cheaper if they have a list so they can just text numbers they know get SMS.
    - pininja 5y ago
      Calling, while cheap, isn’t free or infinitely fast. They’d likely pay for knowing “active” or “lucrative” numbers. Jim Browning videos are a fantastic resource to learn more about the inner workings of scams https://youtube.com/c/JimBrowning https://youtube.com/c/JimBrowning
      - yuy910616 5y ago
        Calling isn't zero cost, and that spammer time isn't zero cost, so in this case, there is a incentive from the spammer to weed out people who costs the most. So isn't the popular idea that you should NOT answer spam calls wrong? Logically, you should answer every spam call and try to get them to stay on the line for as long as possible, therefore maximizing their cost. This is assuming they have some CMS software on the backend that allows them to categorize numbers.
- aaaaaaaaaaab 5y ago
  Is this a US thing? I’ve never received unsolicited spam calls here in Europe…
  - brnt 5y ago
    Got it in France too all the time. Never in Switzerland or the Netherlands though.
    - BrandoElFollito 5y ago
      I got maybe two calls in France in the last 10 years, from companies I am with (but still unsollicited)
    - Bayart 5y ago
      In France I got one that I can remember of in all the time I've had this number, which is over ten years now. And it was an opinion poll. Also got 5 or 6 scam SMS.
  - njovin 5y ago
    Yes, it's pervasive. I get 4-5 calls per day, most of them scams trying to sell auto warranties or cheap vacations. All of them spoof the caller ID of the caller so it looks like somebody from my area. We have a national do-not-call list is a joke but that only holds legitimate businesses accountable. There's almost no enforcement for these fly-by-night companies. There are initiatives in the works to prevent this behavior but they keep getting delayed, presumably because the telcos will have to do some work that doesn't fill their pockets so they're dragging their feet.
  - ASalazarMX 5y ago
    Mexico too. Before the pandemic I had a few spam calls a month, but now there were days when I received 20-50 from a misconfigured call center automatic caller. It forced me to silence all calls from strangers. We have laws and a system to block and report spam callers, but it seems they don't work anymore.
    - 5y ago
- ASalazarMX 5y ago
  The amount of unwanted calls has skyrocketed this last year. I was forced to automatically reject calls that weren't in my contacts. Anyone important already can email or message me. Big email providers are very good at filtering spam, so if enough people blocks calls, the only spam venue left would be instant messaging.
  - yuy910616 5y ago
    I've actually been answering each spam call - and try to get them to stay on the line for as long as possible. My assumption is that they have some sort of CMS software and that it costs money to call. If you don't answer - they'll keep trying you. But if you do answer and costs them money - they'll put you in the 'do not call' list. Just my guess - but so far it has worked for me personally.
    - mwint 5y ago
      I can confirm answering calls and using as much of their time as possible totally works. I’ve been doing this for a year or more now; I get excited when a spammer calls me now. It’s about a monthly affair. I have a bookmark for https://www.getcreditcardnumbers.com/ https://www.getcreditcardnumbers.com/ - I happily give them all the credit card numbers they want (the ones from that site pass the checksum, but of course isn’t valid in combination with a made up expiry and CVC). After a couple card numbers fail, they cuss me out, sometimes threaten my life, and never call again. My theory is they get flagged by their payment processor if they submit many bogus credit card numbers. It’s about a 10-minute investment once a month. Less time than I used to spend answering and hanging up on spam calls.
      - ASalazarMX 5y ago
        This is brilliant. I don't know what a pissed off spammer with who knows how many of your info could do, though. The last time I made one angry for wasting her time, I received even more calls from other spammers.
        5y ago
- paulddraper 5y ago
  I've gotten lots of scam calls over the past 12 months, and lots more over the last 30 days.
- bpicolo 5y ago
  I haven't gotten spam phone calls in 6-12 months. Today, I got 15.
- sillystuff 5y ago
  I'm not sure if it is coincidence, or if it is really helping, but I play SIT code to indicate a number that is not in service at the beginning of my voice mail message. Since then, the number of spam calls I've been receiving has been steadily decreasing. Install sox play -q -n synth 0.2 sin 950;play -q -n synth 0.2 sin 1400;play -q -n synth 0.2 sin 1800
criticaltinker 5y ago
> The seller told Motherboard that 100 million people had their data compromised in the breach. In the forum post, they were offering data on 30 million people for 6 bitcoin, or around $270,000. Is it possible that one day the market for SSNs and other private data will become so saturated that exfiltrating such data becomes unprofitable? On a slightly more serious note, is anyone aware of a compilation of prices paid for such data? I'm imagining something like a Consumer Price Index [1], but for stolen private data. Maybe far in the dystopian future inflation will make life harder for hackers. [1] https://www.bls.gov/cpi/ https://www.bls.gov/cpi/
- onion2k 5y ago
  Is it possible that one day the market for SSNs and other private data will become so saturated that exfiltrating such data becomes unprofitable? The revenue isn't 6 BTC. It's 6 BTC * however many people are willing to buy at that price. More suppliers would surely drive the price down, but at this point there are probably tens of thousands of people who'd buy if the data was cheaper, so it'll remain profitable for a long time.
  - trimbo 5y ago
    If there's a large enough market, why doesn't someone buy it and then undercut the original seller by selling it for 3 BTC? Or 1? (Or maybe they do?)
    - bbarnett 5y ago
      There will be a licensing agreement, of course. (Napoleon Dynamite 'Gawd!')
    - vngzs 5y ago
      The price goes down as a target is in more breaches. If your SSN is previously leaked, it's worth less.
    - deleted 5y ago
      [deleted]
brnt 5y ago
For global companies, can we specify the countries affected? I don't see any details on this anywhere.
- sofixa 5y ago
  The article mentions social security numbers, so i assume the US. (Afaik the German and Austrian equivalents aren't usual referred to as SSN, although i might be mistaken)
  - brnt 5y ago
    In the Netherlands and France it's often translated as such.
    - sofixa 5y ago
      Idk about the Netherlands, but the French one is absolutely not used for random identification - it's only purposes are taxes, health insurance/care, and pensions, so the only institutions who know it and can ask for it are related government things, your employer and medical staff. So a mobile operator having your social security number would be extremely weird.
      - brnt 5y ago
        Hence my confusion.
  - lyx0 5y ago
    I'm a bit late but I contacted the Austrian equivalent (Magenta Telekom) about the breach and was told that the news about the breach only refers exclusively to the American T-Mobile US and that no Magenta Telekom customers (formerly T-Mobile Austria and UPC Austria) were affected. So the German branch should also be safe I assume.
rvz 5y ago
It has been fully admitted. Award this company a colossal fine for getting hacked and having personal user data being leaked over the internet. But also unfortunately, let the SIM hacking games begin.
- derwiki 5y ago
  Would it be beneficial for T-Mobile customers to switch carriers? Or can nothing be done to avoid being SIM hacked at this point?
  - dvdkon 5y ago
    Maybe carriers will finally start taking identity verification seriously. When everyone's name, address and SSN (or equivalent) is leaked, somebody might finally get the idea that they're rubbish secrets. My name and address is actually public as a self-employed Czech. My date of birth shouldn't be hard to find and plenty of people even publish it (why shouldn't they?), my mother's maiden name might be somewhere too, and I don't even have her as a friend on any social media platform. I really think it's time to start accepting no less than a unique password, hardware identification key or a physical visit to a location with a forgery-resistant ID card.
- devnulll 5y ago
  Have any companies had significant fines levied? Certainly nothing large enough to change behavior. The OPM leak remains the most significant overall of which I'm aware. The Experian leak tops my commercial data leak list, although they get bonus points for then selling people their own data protection service(s).
- deadbolt 5y ago
  Is there anything that T-Mobile customers exposed in this leak can do to prevent SIM hacking?
pengaru 5y ago
Why does T-Mobile have SSNs of its subscribers?
- t3rabytes 5y ago
  The big US carriers are post-paid and run credit checks on subscribers.
  - swiley 5y ago
    It's days like today that I'm very glad I use a prepaid VOIP service that accepts bitcoin.
    - gruez 5y ago
      There's even a prepaid e-sim provider that accepts bitcoin: https://silent.link/ https://silent.link/
  - dionidium 5y ago
    Right, but surely they could run your credit and then throw away the data, right? What interest do they have in holding on to it?
    - nealyoung 5y ago
      If you stop paying, they want to make a report to the credit agencies.
      - meowster 5y ago
        I think the solution is simple then: The SSN should be used for read-only. Once the credit report is read/accessed, the credit bureau issues a write-only code. The company then deletes the SSN and only retains the write-only code. If the write-only code is leaked later in a hack, it is useless to criminals trying to open new accounts.
    - social_quotient 5y ago
sangd 5y ago
For the past year, I've been getting random calls and texts from a lot of unknown sources. Many times the callers even spoofed different numbers. And sometimes people call me because they said I called them. I suspect phone user information has been leaking probably in many different ways.
- deleted 5y ago
  [deleted]
- bigwavedave 5y ago
  Those are likely simple robo scam calls. Robo dialers call an absurd amount of numbers on various schedules in something of a brute force social engineering scam. To keep their dialers from getting permanently blocked or reported easily, they spoof the caller ID (usually with an area code similar to the recipient's area code in the hopes that someone will be more likely to answer a call from an unknown number if they think it's local), which is why you will sometimes get texts or calls from people who ask you to stop calling them. These kinds of people are just other recipients of spam calls and your number happened to be the number the robo dialer was using as a spoofed caller ID for them; that kind of thing doesn't really have anything to do with leaked info.
  - sangd 5y ago
    How about in the cases that they have personal info in sms messages or voicemail? Info got picked up from somewhere?
    - bigwavedave 5y ago
      For cases like that specifically, it's probable. But those are just like the scam emails where they say "hey, I know your password is ${OLD_PASSWORD}, I recently hacked your account on a popular 'adult recreation' site, remotely put Spyware on your computer, and recorded you 'entertaining yourself' while browsing videos (you have good taste lol). Send me x bitcoins or I'll email this to all the email and linkedin contacts my spyware found in your computer." It's just an old password found in a breach years ago, they don't have anything else that's real. The difference here is that if they call and leave a voicemail with personal info, go to the police. They're not gonna bother tracking down a social engineering email, but they may be more inclined to go after verbal blackmail.
sergiomattei 5y ago
> The data includes social security numbers, phone numbers, names, physical addresses, unique IMEI numbers, and driver license information, the seller said. Lord, that's an insane amount of data.
- SavantIdiot 5y ago
  Wow, that's a SIM-jacker's paradise of personal data. I haven't had to change a SIM card in a decade, hopefully it is a lot harder now.
  - sscotthall 5y ago
    Coincidentally, I heard from a T-mobile reseller that T-mobile is forcing them to reissue new SIM cards to all their customers. Unclear if this is related, but the timing is interesting. This was communicated a few weeks ago, before the breach was publicly known.
  - ryanmcbride 5y ago
    It's insanely easy to change sim cards. A few times I've done it they haven't even asked for ID. I even set up a 'port out pin' that requires me to give a 6 digit pin anytime I want to change something about my service or get a new sim card, it's 50/50 whether they actually ask for it or not.
    - SavantIdiot 5y ago
      I've been migrating to a Google voice # over the past 3 years, and there are still a few places that won't send texts to it. It is a huge pain in the ass. I can't imagine the average person going through this...
      - ryanmcbride 5y ago
        I don't trust google but I also don't trust any phone carrier. Holding onto privacy is getting harder and harder it almost doesn't even feel worth it anymore.
barbarthjdj 5y ago
If I believe my data (SSN, name, address) has been breached, what should I do? How should I prevent identity theft?
hamburgerwah 5y ago
This should result in the corporate death penalty but won't so will keep happening. If you zeroed out all of the investors this type of mass compromise would immediately cease. As long as -- cost of compromise < cost of security -- on and on this will go.
- mdoms 5y ago
  > If you zeroed out all of the investors this type of mass compromise would immediately cease. It absolutely would not. Yes we would see greater investment in cyber security and it would pay dividends, but the idea that we can totally eliminate data breaches if we just try really super hard is unrealistic.
  - Teever 5y ago
    This is absurd. There is a simple way to eliminate data breaches -- Don't keep data. Humans have been conducting businesses for thousands of years without the need to hoard large quantities of personal data. If there was sufficient regulatory force to induce companies to make the choice between not hoarding data or not existing then I'm sure that business would carry on as it has for millennia.
    - warkdarrior 5y ago
      Businesses have not reached economies of scale until recently, and economies of scale are supported by data.
- yzmtf2008 5y ago
  This doesn't make any sense. Capital punishment has existed since forever - yet the fact that they are still carried out means that they are not stopping all of the crimes punishable by death.
  - dstick 5y ago
    It does make sense. You're confusing corporate liability with personal liability. The parent's point is that if the investors / shareholders would be responsible. Stuff like this would be severely reduced because resources would be allocated to prevent it. Right now, the only damage is a financial one. And as long as the damage is lower than the cost of prevention, hacks like this will continue to happen.
88840-8855 5y ago
The parent company's stock price (Deutsche Telekom) seems not to care at all that this happened. The market seems not to see that data breaches are a risk to business.
- gibba999 5y ago
  They're npt. That's why they happen so often.
deleted 5y ago
[deleted]
aspectmin 5y ago
Maybe it's time we invented robust systems to prevent us from having to share all of our personal data with companies like these, yet still be able to transact with them.
sakopov 5y ago
Between this and Equifax hacks alone, can we make an assumption that the majority of SSNs out there are tainted?
chrischen 5y ago
So given that T-Mobile authenticates me with SSN when I call them does this mean they can’t do this anymore or it opens me up to SIM hijacking?
- pageandrew 5y ago
  I always hated how they did that.
Bhilai 5y ago
T-Mobile is one of the habitual offenders. I am betting on no adverse consequences from this breach also.
janvdberg 5y ago
This tweet explains how they might have gotten in (i.e. unpatched ssh servers) https://twitter.com/damienmiller/status/1427195852011937797?s=21 https://twitter.com/damienmiller/status/1427195852011937797?...
- tyingq 5y ago
  From the picture: https://pbs.twimg.com/media/E848JkGUUAIhIq5?format=jpg&name=medium https://pbs.twimg.com/media/E848JkGUUAIhIq5?format=jpg&name=... "Audit Flags: NO_PCI NO_SOX" Ouch. Also, "IBM 9117-MMD" would be a POWER7+ server that was EOL in December of 2020.
  - oars 5y ago
    What does it mean to have these audit flags enabled in Linux? Auditors can exclude these systems? WTF
    - tyingq 5y ago
      It's not really related to Linux or the OS at all, just some text in /etc/motd or similar. "Audit" in this case is the more generic term relating to the company responsibilities to audit systems with sensitive data. They are saying the system is not subject to governance type controls for either PCI or Sarbanes-Oxley. Which is ironic given what was leaked out of it. And yeah, that probably means they told cybersecurity auditors this system wasn't subject to rules associated with PCI and/or Sarbox.
- gibba999 5y ago
  T-Mobile explicitly excludes out-of-date software from their bug bounty program. Same with CSRF and XSS issues. https://www.telekom.com/en/corporate-responsibility/data-protection-data-security/security/details/closing-security-gaps-360054 https://www.telekom.com/en/corporate-responsibility/data-pro... Most such issues are business-as-usual there.
dang 5y ago
Recent and related: T-Mobile investigating claims of 100M customer data breach - https://news.ycombinator.com/item?id=28192423 https://news.ycombinator.com/item?id=28192423 - Aug 2021 (183 comments)
bogomipz 5y ago
So they didn't learn their lesson after their customer's SSNs were stole in 2015? In that Hack they bizarrely claimed that Experian was storing the SSNs for them.[1] For the record this shitty company also had a customer data breach in 2018[2], 2019[3] and 2020[4]. With this latest hack it makes 6 data breaches in 5 years. At what point will this negligence be considered criminal? [1]https://money.cnn.com/2015/10/01/technology/tmobile-experian-data-breach/ https://money.cnn.com/2015/10/01/technology/tmobile-experian... [2]https://threatpost.com/t-mobile-alerts-2-3-million-customers-of-data-breach-tied-to-leaky-api/136896/ https://threatpost.com/t-mobile-alerts-2-3-million-customers... [3] https://www.geekwire.com/2019/t-mobile-discloses-breach-exposing-1m-customers-personal-information/ https://www.geekwire.com/2019/t-mobile-discloses-breach-expo... [4] https://www.zdnet.com/article/t-mobile-says-hacker-gained-access-to-employee-email-accounts-user-data/ https://www.zdnet.com/article/t-mobile-says-hacker-gained-ac...
m-p-3 5y ago
Equifax: rubs hands
nashashmi 5y ago
Not sure if anyone else can relate but my wife had T-Mobile and was sim hacked. Her bank account got hacked. Her email address got hacked. All because to protect the bank account I put in second factor auth using her T-Mobile number. She talked to her colleagues who reported that their phone was sim hacked too on tmobile. We switched. No hacks now.
- twostorytower 5y ago
  It's very frustrating that most banks have not implemented hardware 2FA (Yubikey or Titan support) let alone authenticator based 2FA. Bank of America is still stuck on SMS. SIM swaps are happening on every carrier.
  - xyst 5y ago
    banks are still trying to modernize their legacy main frame infrastructure from the late 80s to mid 90s. at this rate, a hardware 2fa will be ready by 2030.
  - blackbear_ 5y ago
    Meanwhile my Italian bank recently moved from hardware to SMS 2FA "in an effort to modernize [their] systems". I changed bank.
sneak 5y ago
The problem is not that people keep getting hacked. The problem is that so many vendors won't do business with you without government ID. The hacks would be a nonissue if the vendors would let us open accounts without identity information. I am glad I have an old tmo postpaid account in a fake name with no DOB or SSN on file. I'm not sure such is possible to get today.
exabrial 5y ago
Yet another reason with SMS "2fa" needs to die. Phone carriers are about a hardened as swiss cheese.
leeoniya 5y ago
> Motherboard has seen samples of the data, and confirmed they contained accurate information on T-Mobile customers. The data includes social security numbers... wait, why does t-mobile have SSNs?
- hijinks 5y ago
  credit checks
  - leeoniya 5y ago
    okay, and they store them afterwards? why? and presumably in a non-bcrypted format? :facepalm
atok1 5y ago
This is an extremely sad day for humanity. Privacy is a basic human right, People trusted these companies with their most personal identity information (often due to not having a choice since repressive governments won't allow one to operate a base station) and they completely shit all over that trust. When breaches like this happen, all executives must step down.
ebeip90 5y ago
Interesting, I had a very well-done phone attempt against my American Express card two weeks ago. I have to wonder if all that data came from the TMobile hack. * The caller ID was spoofed (not just the name, the actual number on my phone bill and phone app logs are a real AMEX number). * The caller claimed to be reporting a fraudulent attempt on my account * In order to verify my identity, please read back the six-digit PIN they're sending me (~ALARM BELLS GO OFF~) * SMS 2FA shows up, "Enter this code to add your card to Apple Pay" (Oddly, this message doesn't carry the "WE WILL NEVER CALL YOU FOR THIS CODE" all previous SMS 2FA carried) * I ask for a call-back number, for security purposes. I'm told "This is AMEX. This is AMEX." every time I ask. I hung up, and froze the card. Then I called AMEX with the number listed on the back of the card. They acknowledged they did NOT call me at any point that day, that a transaction WAS attempted AFTER I froze the card, and issued a new card. The caller was calm, call-centery, had my full name, credit card number, expiration, 4-digit CVV, and phone number. I also learned that AMEX doesn't actually cancel the old card... my regularly billed transactions and new online purchases went through just fine with the old card info. I called AMEX to ask them to unambiguously reject all attempts for all previous card numbers, they acknowledged. Tried a few days later, the old number still works...
- AbacusAvenger 5y ago
  I had a very similar pattern happen a year or so ago on one of my bank debit cards. The difference in my case was that they made one fraudulent charge on the card beforehand to lend authenticity to the "we're the fraud team" claim. They knew the card number, and the details about the charge (presumably because they were the ones who made the charge). Then they tried to reset the password for my online banking login and asked me to read the security code I received via SMS to confirm my identity. Luckily the code sent to me was clearly labeled as a password reset code (though not with the "we won't ask for this code over the phone" line), so I froze the card and went down to my bank to talk about it. Apparently it had happened to a lot of my bank's members, and I was one of the few to not fall for it.
ColemanJ 5y ago
I personally only had 2 things to be removed off my credit report, as I see some people had good reviews about TROVIAN CREDIT REPAIR, I don't see how unless they were made up. Mine was simple because I had couple of things that needs to be removed I was concern about my credit, so I contacted Trovian Teams and they understand my concerns about my credit issues and went ahead with the repairing process in less than 5days the credit bureaus stated they have validated the correction on my credit files with a high score, the issues I needed removed and I got approved for my first home purchase. They are good in fixing credit issues and I will like everyone out there to contact them now TROVIANCREDITREPAIR@GMAIL.COM/ +1 (505) 926 3648.
ColemanJ 5y ago
I personally only had 2 things to be removed off my credit report, as I see some people had good reviews about TROVIAN CREDIT REPAIR, I don't see how unless they were made up. Mine was simple because I had couple of things that needs to be removed I was concern about my credit, so I contacted Trovian Teams and they understand my concerns about my credit issues and went ahead with the repairing process in less than 5days the credit bureaus stated they have validated the correction on my credit files with a high score, the issues I needed removed and I got approved for my first home purchase. They are good in fixing credit issues and I will like everyone out there to contact them now TROVIANCREDITREPAIR at GMAIL dot COM

432 points by jbegley 5y ago

I had 5 spam calls this morning from various suspicious phone numbers, including one from Europe. That's more than I've gotten since I first got this phone number total. I guess it's unreasonable to expect the good times to last like that but man, I'm still deeply unhappy with T-Mobile right now.

samstave 5y ago
I get numbers from EU as well -- and I get some at ~3AM PST as well...
dheera 5y ago
I get about 10+ spam calls a day, I just block all calls except for a couple of whitelisted numbers, and forward the rest to something that plays a hold song endlessly.
- ARandomerDude 5y ago
  In before a 20yo culture warrior says "allowlist."
- capitainenemo 5y ago
  Sometimes I get calls from people I forget to whitelist or who might actually be important (workmen for example). So, I have my default phone ringtone set to a 0.1s, 200 byte mp3 of silence. Anyone in my address book gets my standard address book ringtone. Then I just check the emails of the voicemails once a day.
abawany 5y ago
Google Voice (GV) and Voip.ms have fairly sophisticated screening that tends to get the 'vehicle warranty' bots to hang up quickly. I wish our phone carriers offered such methods to ensure that their 'services' remain relevant in an increasingly spammy world. Edit: for GV, you will need to enable screening by going to https://voice.google.com/u/0/settings https://voice.google.com/u/0/settings and setting "Screen calls" and for Voip.ms, you will need to setup a IVR so that callers have to enter in a code before they are allowed through.
- dopamean 5y ago
  I've been using google voice for 7+ years and I get a TON of those vehicle warranty calls. At least one almost every day.
  - abawany 5y ago
    You need to enable screening by going to https://voice.google.com/u/0/settings https://voice.google.com/u/0/settings .
    - mfkp 5y ago
      I've got screening enabled and still get at least 3 spam calls per day, usually more.
      - abawany 5y ago
        I am surprised - they are ringing your phone/the app vs. just ending up as 'missed calls'? I presume you are also marking them as spam to prevent recurrence and that these numbers are not in your contacts? (Not being sarcastic, just trying to help.)
        mfkp 5y ago
        Yes, it rings my phone. Most are annoyingly early in the morning, and 90% of the time it comes from random numbers in the same area code as my phone number. I haven't been marking the numbers as spam, but maybe I'll try to do that to see if the number of calls reduces.
        abawany 5y ago
        One more thing to check: in the Legacy GV webapp (google.com/voice/b/0/redirection/voice) in the Groups tab, the Screening is On for anonymous callers in addition to the original place that I listed above? Hopefully marking as spam will help too. One thing I like about Voip.ms vs. GV is that in the former, I can mass block an entire range of number using wildcards, which is rather satisfying especially since I setup the rules to ring as busy vs. just hanging up to keep their systems online a bit longer vs. freeing them to disrupt their next victim.
S_A_P 5y ago
Don't feel bad- Im on AT&T and Ive noticed a HUGE uptick in spam sms messages. Pretty sure my number was leaked in some breach.
- judge2020 5y ago
  For what it's worth I've continued to report these to both AT&T[0] and Safe Browsing[1]. 0: https://www.att.com/support/article/my-account/KM1051831/#:~:text=Alert%20AT%26T%20by%20forwarding%20the%20suspicious%20text%20to%207726%20on%20your%20device https://www.att.com/support/article/my-account/KM1051831/#:~.... 1: https://safebrowsing.google.com/safebrowsing/report_general/ https://safebrowsing.google.com/safebrowsing/report_general/
- gruez 5y ago
  >Pretty sure my number was leaked in some breach. Why do spammers need leaked phone numbers? Can't they just call/message every number?
  - easrng 5y ago
    They can and do, but it's cheaper if they have a list so they can just text numbers they know get SMS.
  - pininja 5y ago
    Calling, while cheap, isn’t free or infinitely fast. They’d likely pay for knowing “active” or “lucrative” numbers. Jim Browning videos are a fantastic resource to learn more about the inner workings of scams https://youtube.com/c/JimBrowning https://youtube.com/c/JimBrowning
    - yuy910616 5y ago
      Calling isn't zero cost, and that spammer time isn't zero cost, so in this case, there is a incentive from the spammer to weed out people who costs the most. So isn't the popular idea that you should NOT answer spam calls wrong? Logically, you should answer every spam call and try to get them to stay on the line for as long as possible, therefore maximizing their cost. This is assuming they have some CMS software on the backend that allows them to categorize numbers.
aaaaaaaaaaab 5y ago
Is this a US thing? I’ve never received unsolicited spam calls here in Europe…
- brnt 5y ago
  Got it in France too all the time. Never in Switzerland or the Netherlands though.
  - BrandoElFollito 5y ago
    I got maybe two calls in France in the last 10 years, from companies I am with (but still unsollicited)
  - Bayart 5y ago
    In France I got one that I can remember of in all the time I've had this number, which is over ten years now. And it was an opinion poll. Also got 5 or 6 scam SMS.
- njovin 5y ago
  Yes, it's pervasive. I get 4-5 calls per day, most of them scams trying to sell auto warranties or cheap vacations. All of them spoof the caller ID of the caller so it looks like somebody from my area. We have a national do-not-call list is a joke but that only holds legitimate businesses accountable. There's almost no enforcement for these fly-by-night companies. There are initiatives in the works to prevent this behavior but they keep getting delayed, presumably because the telcos will have to do some work that doesn't fill their pockets so they're dragging their feet.
- ASalazarMX 5y ago
  Mexico too. Before the pandemic I had a few spam calls a month, but now there were days when I received 20-50 from a misconfigured call center automatic caller. It forced me to silence all calls from strangers. We have laws and a system to block and report spam callers, but it seems they don't work anymore.
  - 5y ago
ASalazarMX 5y ago
The amount of unwanted calls has skyrocketed this last year. I was forced to automatically reject calls that weren't in my contacts. Anyone important already can email or message me. Big email providers are very good at filtering spam, so if enough people blocks calls, the only spam venue left would be instant messaging.
- yuy910616 5y ago
  I've actually been answering each spam call - and try to get them to stay on the line for as long as possible. My assumption is that they have some sort of CMS software and that it costs money to call. If you don't answer - they'll keep trying you. But if you do answer and costs them money - they'll put you in the 'do not call' list. Just my guess - but so far it has worked for me personally.
  - mwint 5y ago
    I can confirm answering calls and using as much of their time as possible totally works. I’ve been doing this for a year or more now; I get excited when a spammer calls me now. It’s about a monthly affair. I have a bookmark for https://www.getcreditcardnumbers.com/ https://www.getcreditcardnumbers.com/ - I happily give them all the credit card numbers they want (the ones from that site pass the checksum, but of course isn’t valid in combination with a made up expiry and CVC). After a couple card numbers fail, they cuss me out, sometimes threaten my life, and never call again. My theory is they get flagged by their payment processor if they submit many bogus credit card numbers. It’s about a 10-minute investment once a month. Less time than I used to spend answering and hanging up on spam calls.
    - ASalazarMX 5y ago
      This is brilliant. I don't know what a pissed off spammer with who knows how many of your info could do, though. The last time I made one angry for wasting her time, I received even more calls from other spammers.
      - 5y ago
paulddraper 5y ago
I've gotten lots of scam calls over the past 12 months, and lots more over the last 30 days.
bpicolo 5y ago
I haven't gotten spam phone calls in 6-12 months. Today, I got 15.
sillystuff 5y ago
I'm not sure if it is coincidence, or if it is really helping, but I play SIT code to indicate a number that is not in service at the beginning of my voice mail message. Since then, the number of spam calls I've been receiving has been steadily decreasing. Install sox play -q -n synth 0.2 sin 950;play -q -n synth 0.2 sin 1400;play -q -n synth 0.2 sin 1800

criticaltinker 5y ago

> The seller told Motherboard that 100 million people had their data compromised in the breach. In the forum post, they were offering data on 30 million people for 6 bitcoin, or around $270,000. Is it possible that one day the market for SSNs and other private data will become so saturated that exfiltrating such data becomes unprofitable? On a slightly more serious note, is anyone aware of a compilation of prices paid for such data? I'm imagining something like a Consumer Price Index [1], but for stolen private data. Maybe far in the dystopian future inflation will make life harder for hackers. [1] https://www.bls.gov/cpi/ https://www.bls.gov/cpi/

onion2k 5y ago
Is it possible that one day the market for SSNs and other private data will become so saturated that exfiltrating such data becomes unprofitable? The revenue isn't 6 BTC. It's 6 BTC * however many people are willing to buy at that price. More suppliers would surely drive the price down, but at this point there are probably tens of thousands of people who'd buy if the data was cheaper, so it'll remain profitable for a long time.
- trimbo 5y ago
  If there's a large enough market, why doesn't someone buy it and then undercut the original seller by selling it for 3 BTC? Or 1? (Or maybe they do?)
  - bbarnett 5y ago
    There will be a licensing agreement, of course. (Napoleon Dynamite 'Gawd!')
  - vngzs 5y ago
    The price goes down as a target is in more breaches. If your SSN is previously leaked, it's worth less.
  - deleted 5y ago
    [deleted]

brnt 5y ago

For global companies, can we specify the countries affected? I don't see any details on this anywhere.

sofixa 5y ago
The article mentions social security numbers, so i assume the US. (Afaik the German and Austrian equivalents aren't usual referred to as SSN, although i might be mistaken)
- brnt 5y ago
  In the Netherlands and France it's often translated as such.
  - sofixa 5y ago
    Idk about the Netherlands, but the French one is absolutely not used for random identification - it's only purposes are taxes, health insurance/care, and pensions, so the only institutions who know it and can ask for it are related government things, your employer and medical staff. So a mobile operator having your social security number would be extremely weird.
    - brnt 5y ago
      Hence my confusion.
- lyx0 5y ago
  I'm a bit late but I contacted the Austrian equivalent (Magenta Telekom) about the breach and was told that the news about the breach only refers exclusively to the American T-Mobile US and that no Magenta Telekom customers (formerly T-Mobile Austria and UPC Austria) were affected. So the German branch should also be safe I assume.

rvz 5y ago

It has been fully admitted. Award this company a colossal fine for getting hacked and having personal user data being leaked over the internet. But also unfortunately, let the SIM hacking games begin.

derwiki 5y ago
Would it be beneficial for T-Mobile customers to switch carriers? Or can nothing be done to avoid being SIM hacked at this point?
- dvdkon 5y ago
  Maybe carriers will finally start taking identity verification seriously. When everyone's name, address and SSN (or equivalent) is leaked, somebody might finally get the idea that they're rubbish secrets. My name and address is actually public as a self-employed Czech. My date of birth shouldn't be hard to find and plenty of people even publish it (why shouldn't they?), my mother's maiden name might be somewhere too, and I don't even have her as a friend on any social media platform. I really think it's time to start accepting no less than a unique password, hardware identification key or a physical visit to a location with a forgery-resistant ID card.
devnulll 5y ago
Have any companies had significant fines levied? Certainly nothing large enough to change behavior. The OPM leak remains the most significant overall of which I'm aware. The Experian leak tops my commercial data leak list, although they get bonus points for then selling people their own data protection service(s).
deadbolt 5y ago
Is there anything that T-Mobile customers exposed in this leak can do to prevent SIM hacking?

pengaru 5y ago

Why does T-Mobile have SSNs of its subscribers?

t3rabytes 5y ago
The big US carriers are post-paid and run credit checks on subscribers.
- swiley 5y ago
  It's days like today that I'm very glad I use a prepaid VOIP service that accepts bitcoin.
  - gruez 5y ago
    There's even a prepaid e-sim provider that accepts bitcoin: https://silent.link/ https://silent.link/
- dionidium 5y ago
  Right, but surely they could run your credit and then throw away the data, right? What interest do they have in holding on to it?
  - nealyoung 5y ago
    If you stop paying, they want to make a report to the credit agencies.
    - meowster 5y ago
      I think the solution is simple then: The SSN should be used for read-only. Once the credit report is read/accessed, the credit bureau issues a write-only code. The company then deletes the SSN and only retains the write-only code. If the write-only code is leaked later in a hack, it is useless to criminals trying to open new accounts.
  - social_quotient 5y ago

sangd 5y ago

For the past year, I've been getting random calls and texts from a lot of unknown sources. Many times the callers even spoofed different numbers. And sometimes people call me because they said I called them. I suspect phone user information has been leaking probably in many different ways.

deleted 5y ago
[deleted]
bigwavedave 5y ago
Those are likely simple robo scam calls. Robo dialers call an absurd amount of numbers on various schedules in something of a brute force social engineering scam. To keep their dialers from getting permanently blocked or reported easily, they spoof the caller ID (usually with an area code similar to the recipient's area code in the hopes that someone will be more likely to answer a call from an unknown number if they think it's local), which is why you will sometimes get texts or calls from people who ask you to stop calling them. These kinds of people are just other recipients of spam calls and your number happened to be the number the robo dialer was using as a spoofed caller ID for them; that kind of thing doesn't really have anything to do with leaked info.
- sangd 5y ago
  How about in the cases that they have personal info in sms messages or voicemail? Info got picked up from somewhere?
  - bigwavedave 5y ago
    For cases like that specifically, it's probable. But those are just like the scam emails where they say "hey, I know your password is ${OLD_PASSWORD}, I recently hacked your account on a popular 'adult recreation' site, remotely put Spyware on your computer, and recorded you 'entertaining yourself' while browsing videos (you have good taste lol). Send me x bitcoins or I'll email this to all the email and linkedin contacts my spyware found in your computer." It's just an old password found in a breach years ago, they don't have anything else that's real. The difference here is that if they call and leave a voicemail with personal info, go to the police. They're not gonna bother tracking down a social engineering email, but they may be more inclined to go after verbal blackmail.

sergiomattei 5y ago

> The data includes social security numbers, phone numbers, names, physical addresses, unique IMEI numbers, and driver license information, the seller said. Lord, that's an insane amount of data.

SavantIdiot 5y ago
Wow, that's a SIM-jacker's paradise of personal data. I haven't had to change a SIM card in a decade, hopefully it is a lot harder now.
- sscotthall 5y ago
  Coincidentally, I heard from a T-mobile reseller that T-mobile is forcing them to reissue new SIM cards to all their customers. Unclear if this is related, but the timing is interesting. This was communicated a few weeks ago, before the breach was publicly known.
- ryanmcbride 5y ago
  It's insanely easy to change sim cards. A few times I've done it they haven't even asked for ID. I even set up a 'port out pin' that requires me to give a 6 digit pin anytime I want to change something about my service or get a new sim card, it's 50/50 whether they actually ask for it or not.
  - SavantIdiot 5y ago
    I've been migrating to a Google voice # over the past 3 years, and there are still a few places that won't send texts to it. It is a huge pain in the ass. I can't imagine the average person going through this...
    - ryanmcbride 5y ago
      I don't trust google but I also don't trust any phone carrier. Holding onto privacy is getting harder and harder it almost doesn't even feel worth it anymore.

barbarthjdj 5y ago

If I believe my data (SSN, name, address) has been breached, what should I do? How should I prevent identity theft?

hamburgerwah 5y ago

This should result in the corporate death penalty but won't so will keep happening. If you zeroed out all of the investors this type of mass compromise would immediately cease. As long as -- cost of compromise < cost of security -- on and on this will go.

mdoms 5y ago
> If you zeroed out all of the investors this type of mass compromise would immediately cease. It absolutely would not. Yes we would see greater investment in cyber security and it would pay dividends, but the idea that we can totally eliminate data breaches if we just try really super hard is unrealistic.
- Teever 5y ago
  This is absurd. There is a simple way to eliminate data breaches -- Don't keep data. Humans have been conducting businesses for thousands of years without the need to hoard large quantities of personal data. If there was sufficient regulatory force to induce companies to make the choice between not hoarding data or not existing then I'm sure that business would carry on as it has for millennia.
  - warkdarrior 5y ago
    Businesses have not reached economies of scale until recently, and economies of scale are supported by data.
yzmtf2008 5y ago
This doesn't make any sense. Capital punishment has existed since forever - yet the fact that they are still carried out means that they are not stopping all of the crimes punishable by death.
- dstick 5y ago
  It does make sense. You're confusing corporate liability with personal liability. The parent's point is that if the investors / shareholders would be responsible. Stuff like this would be severely reduced because resources would be allocated to prevent it. Right now, the only damage is a financial one. And as long as the damage is lower than the cost of prevention, hacks like this will continue to happen.

88840-8855 5y ago

The parent company's stock price (Deutsche Telekom) seems not to care at all that this happened. The market seems not to see that data breaches are a risk to business.

gibba999 5y ago
They're npt. That's why they happen so often.

deleted 5y ago

[deleted]

aspectmin 5y ago

Maybe it's time we invented robust systems to prevent us from having to share all of our personal data with companies like these, yet still be able to transact with them.

sakopov 5y ago

Between this and Equifax hacks alone, can we make an assumption that the majority of SSNs out there are tainted?

chrischen 5y ago

So given that T-Mobile authenticates me with SSN when I call them does this mean they can’t do this anymore or it opens me up to SIM hijacking?

pageandrew 5y ago
I always hated how they did that.

Bhilai 5y ago

T-Mobile is one of the habitual offenders. I am betting on no adverse consequences from this breach also.

janvdberg 5y ago

This tweet explains how they might have gotten in (i.e. unpatched ssh servers) https://twitter.com/damienmiller/status/1427195852011937797?s=21 https://twitter.com/damienmiller/status/1427195852011937797?...

tyingq 5y ago
From the picture: https://pbs.twimg.com/media/E848JkGUUAIhIq5?format=jpg&name=medium https://pbs.twimg.com/media/E848JkGUUAIhIq5?format=jpg&name=... "Audit Flags: NO_PCI NO_SOX" Ouch. Also, "IBM 9117-MMD" would be a POWER7+ server that was EOL in December of 2020.
- oars 5y ago
  What does it mean to have these audit flags enabled in Linux? Auditors can exclude these systems? WTF
  - tyingq 5y ago
    It's not really related to Linux or the OS at all, just some text in /etc/motd or similar. "Audit" in this case is the more generic term relating to the company responsibilities to audit systems with sensitive data. They are saying the system is not subject to governance type controls for either PCI or Sarbanes-Oxley. Which is ironic given what was leaked out of it. And yeah, that probably means they told cybersecurity auditors this system wasn't subject to rules associated with PCI and/or Sarbox.
gibba999 5y ago
T-Mobile explicitly excludes out-of-date software from their bug bounty program. Same with CSRF and XSS issues. https://www.telekom.com/en/corporate-responsibility/data-protection-data-security/security/details/closing-security-gaps-360054 https://www.telekom.com/en/corporate-responsibility/data-pro... Most such issues are business-as-usual there.

dang 5y ago

Recent and related: T-Mobile investigating claims of 100M customer data breach - https://news.ycombinator.com/item?id=28192423 https://news.ycombinator.com/item?id=28192423 - Aug 2021 (183 comments)

bogomipz 5y ago

So they didn't learn their lesson after their customer's SSNs were stole in 2015? In that Hack they bizarrely claimed that Experian was storing the SSNs for them.[1] For the record this shitty company also had a customer data breach in 2018[2], 2019[3] and 2020[4]. With this latest hack it makes 6 data breaches in 5 years. At what point will this negligence be considered criminal? [1]https://money.cnn.com/2015/10/01/technology/tmobile-experian-data-breach/ https://money.cnn.com/2015/10/01/technology/tmobile-experian... [2]https://threatpost.com/t-mobile-alerts-2-3-million-customers-of-data-breach-tied-to-leaky-api/136896/ https://threatpost.com/t-mobile-alerts-2-3-million-customers... [3] https://www.geekwire.com/2019/t-mobile-discloses-breach-exposing-1m-customers-personal-information/ https://www.geekwire.com/2019/t-mobile-discloses-breach-expo... [4] https://www.zdnet.com/article/t-mobile-says-hacker-gained-access-to-employee-email-accounts-user-data/ https://www.zdnet.com/article/t-mobile-says-hacker-gained-ac...

m-p-3 5y ago

Equifax: rubs hands

nashashmi 5y ago

Not sure if anyone else can relate but my wife had T-Mobile and was sim hacked. Her bank account got hacked. Her email address got hacked. All because to protect the bank account I put in second factor auth using her T-Mobile number. She talked to her colleagues who reported that their phone was sim hacked too on tmobile. We switched. No hacks now.

twostorytower 5y ago
It's very frustrating that most banks have not implemented hardware 2FA (Yubikey or Titan support) let alone authenticator based 2FA. Bank of America is still stuck on SMS. SIM swaps are happening on every carrier.
- xyst 5y ago
  banks are still trying to modernize their legacy main frame infrastructure from the late 80s to mid 90s. at this rate, a hardware 2fa will be ready by 2030.
- blackbear_ 5y ago
  Meanwhile my Italian bank recently moved from hardware to SMS 2FA "in an effort to modernize [their] systems". I changed bank.

sneak 5y ago

The problem is not that people keep getting hacked. The problem is that so many vendors won't do business with you without government ID. The hacks would be a nonissue if the vendors would let us open accounts without identity information. I am glad I have an old tmo postpaid account in a fake name with no DOB or SSN on file. I'm not sure such is possible to get today.

exabrial 5y ago

Yet another reason with SMS "2fa" needs to die. Phone carriers are about a hardened as swiss cheese.

leeoniya 5y ago

> Motherboard has seen samples of the data, and confirmed they contained accurate information on T-Mobile customers. The data includes social security numbers... wait, why does t-mobile have SSNs?

hijinks 5y ago
credit checks
- leeoniya 5y ago
  okay, and they store them afterwards? why? and presumably in a non-bcrypted format? :facepalm

atok1 5y ago

This is an extremely sad day for humanity. Privacy is a basic human right, People trusted these companies with their most personal identity information (often due to not having a choice since repressive governments won't allow one to operate a base station) and they completely shit all over that trust. When breaches like this happen, all executives must step down.

ebeip90 5y ago

Interesting, I had a very well-done phone attempt against my American Express card two weeks ago. I have to wonder if all that data came from the TMobile hack. * The caller ID was spoofed (not just the name, the actual number on my phone bill and phone app logs are a real AMEX number). * The caller claimed to be reporting a fraudulent attempt on my account * In order to verify my identity, please read back the six-digit PIN they're sending me (~ALARM BELLS GO OFF~) * SMS 2FA shows up, "Enter this code to add your card to Apple Pay" (Oddly, this message doesn't carry the "WE WILL NEVER CALL YOU FOR THIS CODE" all previous SMS 2FA carried) * I ask for a call-back number, for security purposes. I'm told "This is AMEX. This is AMEX." every time I ask. I hung up, and froze the card. Then I called AMEX with the number listed on the back of the card. They acknowledged they did NOT call me at any point that day, that a transaction WAS attempted AFTER I froze the card, and issued a new card. The caller was calm, call-centery, had my full name, credit card number, expiration, 4-digit CVV, and phone number. I also learned that AMEX doesn't actually cancel the old card... my regularly billed transactions and new online purchases went through just fine with the old card info. I called AMEX to ask them to unambiguously reject all attempts for all previous card numbers, they acknowledged. Tried a few days later, the old number still works...

AbacusAvenger 5y ago
I had a very similar pattern happen a year or so ago on one of my bank debit cards. The difference in my case was that they made one fraudulent charge on the card beforehand to lend authenticity to the "we're the fraud team" claim. They knew the card number, and the details about the charge (presumably because they were the ones who made the charge). Then they tried to reset the password for my online banking login and asked me to read the security code I received via SMS to confirm my identity. Luckily the code sent to me was clearly labeled as a password reset code (though not with the "we won't ask for this code over the phone" line), so I froze the card and went down to my bank to talk about it. Apparently it had happened to a lot of my bank's members, and I was one of the few to not fall for it.

ColemanJ 5y ago

I personally only had 2 things to be removed off my credit report, as I see some people had good reviews about TROVIAN CREDIT REPAIR, I don't see how unless they were made up. Mine was simple because I had couple of things that needs to be removed I was concern about my credit, so I contacted Trovian Teams and they understand my concerns about my credit issues and went ahead with the repairing process in less than 5days the credit bureaus stated they have validated the correction on my credit files with a high score, the issues I needed removed and I got approved for my first home purchase. They are good in fixing credit issues and I will like everyone out there to contact them now TROVIANCREDITREPAIR@GMAIL.COM/ +1 (505) 926 3648.

ColemanJ 5y ago