10 ms·

This is the text I got from T-Mobile: T-Mobile has determined that unauthorized access to some of your information, or others on your account, has occurred, li

This is the text I got from T-Mobile: T-Mobile has determined that unauthorized access to some of your information, or others on your account, has occurred, like name, address, phone number and DOB. Importantly, we have NO information that indicates your SSN, personal financial or payment information, credit/debit card information, account numbers, or account passwords were accessed. We take the protection of our customers seriously. Learn more about practices that keep your account secure and general recommendations for protecting yourself: t-mo.co/Protect It's such a shit feeling knowing my name and info are out there and that it's only a matter of time before they make attempts on my accounts or identity, I'm one of tens of millions and can only hope that I'm far down the list. I'm usually pretty good with online security, I don't even reuse usernames or emails to sign up for different services, use 2fa for anything important, use containerized tabs for social websites, use VPNs on non-familiar site so some random guy's blog doesn't have my IP, etc... and there goes my cell phone provider fucking things up for me anyways. I don't even know if this is actionable info, should I even bother? Should I get a new number and replace my number at all services that use this number?

MeinBlutIstBlau 5y ago
The only time it's actionable is if you inquire damages honestly. And even then it's an uphill battle cause you'll have to prove it was because of the leak and not something else.
acomjean 5y ago
Lamentably, we're at the point where your information is likely out there. It is a shitty feeling, being the victim. I got the email from my employeer this year that my application for unemployment was reject because I'm still working (I didn't apply). I had an tax check stolen and attempted to cash.. (the bank stopped that one.. Dominican Republic bank cashed that one..), IBM backup tapes with maybe my personal information went missing.. A friend who is supper vigilant had someone apply for a credit card with his credentials.. The card company sent him a letter asking if he had moved.. The card was approved and ready to go. Its sad, but you have to stay vigilant. I don't know if its worth getting a new cell number. It is kinda your identity now.
- BenjiWiebe 5y ago
  Lock your credit.
  - acomjean 5y ago
    Thanks. It’s locked through the 3 US credit company.
brightball 5y ago
Name, address and phone number has been available for a long time in the phone book. People throw parties and post birthday information all over social media constantly. That information shouldn't be a risk. It's too easy to get for everybody.
- dylan604 5y ago
  I never posted my real birthday on social media, but then one day it magically showed up on IMDB. That one still pisses me off. Information posted in the phone books during the time of phone books couldn't really be weaponized against you like it can be now. So yes, times have changed. Just because something used to be done doesn't mean it should still be done that way.
  - taeric 5y ago
    I think the aim of who you responded to was that we should find ways to blunt the weaponization of this information. For my part, I think both can be pursued. Let's do what we can to help keep things private. Let's also do what we can to keep things irrelevant.
    - dylan604 5y ago
      The fact that previous address is relevant is such a strange thing to me. I can't think of anything this actually solves by using, yet it is everywhere with "confirming" you are you. I know I am me, and here's all of these other government issued IDs that say I am me. Prior address does not.
      - taeric 5y ago
        Well.. Except for the fact that my ID has sometimes had my previous address. :) Especially common for folks that move a lot. Students, for example.
        dylan604 5y ago
zz865 5y ago
I got a message that they changed my pin and put the new pin in the sms message. Kinda shocked.
tmaly 5y ago
I got the same text. I think if people get access to your number, and your number is used as part of a 2fa for another service like your bank, then it is only a matter of time before you get hacked.
nonfamous 5y ago
I got the same text, and I’ve never had a prepaid phone. The exposure clearly goes beyond the credit applications T-mobile claims.
chris37879 5y ago
Are you an adult over the age of 21? Cause if so all your info was likely dumped in the Equifax breach a couple years ago if you had interacted with credit in anyway. It's one of those things that you just have to accept its out there and secure yourself the best you can, 2fa everywhere, password manager, don't re-use passwords, etc. Most of that info is most dangerous when it can be used to break into a weaker account that may be used as auth for a stronger account, like T-Mo redirecting your 2fa texts to an attacker that paid off a customer support agent to sim swap your number. Your phone line is a huge security liability because of 2fa texts and the lax policies around line transfers. And this basically extends to any server, if they can get into your email, they can get into any account that uses your email as auth.
- jghn 5y ago
  The thing I haven't been able to figure out, once reaching the mental place you describe above, was what to do about it. It really feels like the answer is "do nothing, and hope no one ruins your life". Which isn't a great place to be.
  - Ironlink 5y ago
    I guess the only course of action would be to work to make the leaked information out of date. You could change your name and address. Personally, I would not pursue that option.
  - chris37879 5y ago
    I really wish I had a better answer for you, but I'm stuck there myself. Short of major reform that those that profit off this shit will just lobby away, there's literally nothing we can do but wait for the current notion of credit to collapse, unfortunately.
com2kid 5y ago
I live in Washington State, where up until recently, birth records for anyone could be requested by anyone. Address? If you own a home, already a matter of public record. Phone #, not secret at all (heck it is part of many people's email signatures!) Talk to an investigative journalist some time and find out exactly what info can be had publicly. On a related topic, a few years back I went to a presentation from a member of TMO's marketing team. They mentioned how they used a ad-tech company to real time query the mortgage status of people who visited TMO's homepage in order to help dynamically determine what line of phones to show. Live in a nice neighborhood and didn't have a bunch of late payments? iPhones showed up. To be clear, their is a vendor out there with an API that offers up, in real time, what your current mortgage status is. "You" of course are determined by a bunch of other web trackers. A few weeks ago Best Buy sold off the the fact that I was in their store looking at robotic vacuum cleaners. (Either that or some app on my phone was using really good location tracking, but Android has seriously cut down on that, AFAIK background apps aren't granular enough anymore to get section-in-store data) While I was impressed with the ad tech that made that level of targeting possible, it also means I am not likely to step inside a best buy again.
- techrat 5y ago
  Have you noticed that in Best Buy stores their price tags are now all eink paper? If they can 'electronify' a price tag, you know they have some precise beacons in that store.
  - deleted 5y ago
    [deleted]
- ROARosen 5y ago
  Could be ultrasonic tracking beacons, see here: https://www.wired.com/2017/05/hundreds-apps-can-listen-beacons-cant-hear/ https://www.wired.com/2017/05/hundreds-apps-can-listen-beaco...
- zxcvbn4038 5y ago
  I can always tell what my wife is buying for my birthday, I get ads for the stuff she searches for even though we do not share devices, Google seems to make associations from the IP address. I watched a video review of a drone on YouTube and that was a huge mistake, got slammed with drone ads for weeks afterwards. Watching any video mentioning “Planet X” seems to sign you up for a semi truck full of crazy also.
SkyMarshal 5y ago
> Should I get a new number and replace my number at all services that use this number? Here's a guide to removing your phone number from all security functions: https://blog.kraken.com/post/219/security-advisory-mobile-phones/ https://blog.kraken.com/post/219/security-advisory-mobile-ph... Just made a separate post about it here, since it doesn't appear to have been posted at HN before: https://news.ycombinator.com/edit?id=28283321 https://news.ycombinator.com/edit?id=28283321
- neither_color 5y ago
  Thank you, this is very useful info.

MeinBlutIstBlau 5y ago

The only time it's actionable is if you inquire damages honestly. And even then it's an uphill battle cause you'll have to prove it was because of the leak and not something else.

acomjean 5y ago

Lamentably, we're at the point where your information is likely out there. It is a shitty feeling, being the victim. I got the email from my employeer this year that my application for unemployment was reject because I'm still working (I didn't apply). I had an tax check stolen and attempted to cash.. (the bank stopped that one.. Dominican Republic bank cashed that one..), IBM backup tapes with maybe my personal information went missing.. A friend who is supper vigilant had someone apply for a credit card with his credentials.. The card company sent him a letter asking if he had moved.. The card was approved and ready to go. Its sad, but you have to stay vigilant. I don't know if its worth getting a new cell number. It is kinda your identity now.

BenjiWiebe 5y ago
Lock your credit.
- acomjean 5y ago
  Thanks. It’s locked through the 3 US credit company.

brightball 5y ago

Name, address and phone number has been available for a long time in the phone book. People throw parties and post birthday information all over social media constantly. That information shouldn't be a risk. It's too easy to get for everybody.

dylan604 5y ago
I never posted my real birthday on social media, but then one day it magically showed up on IMDB. That one still pisses me off. Information posted in the phone books during the time of phone books couldn't really be weaponized against you like it can be now. So yes, times have changed. Just because something used to be done doesn't mean it should still be done that way.
- taeric 5y ago
  I think the aim of who you responded to was that we should find ways to blunt the weaponization of this information. For my part, I think both can be pursued. Let's do what we can to help keep things private. Let's also do what we can to keep things irrelevant.
  - dylan604 5y ago
    The fact that previous address is relevant is such a strange thing to me. I can't think of anything this actually solves by using, yet it is everywhere with "confirming" you are you. I know I am me, and here's all of these other government issued IDs that say I am me. Prior address does not.
    - taeric 5y ago
      Well.. Except for the fact that my ID has sometimes had my previous address. :) Especially common for folks that move a lot. Students, for example.
      - dylan604 5y ago

zz865 5y ago

I got a message that they changed my pin and put the new pin in the sms message. Kinda shocked.

tmaly 5y ago

I got the same text. I think if people get access to your number, and your number is used as part of a 2fa for another service like your bank, then it is only a matter of time before you get hacked.

nonfamous 5y ago

I got the same text, and I’ve never had a prepaid phone. The exposure clearly goes beyond the credit applications T-mobile claims.

chris37879 5y ago

Are you an adult over the age of 21? Cause if so all your info was likely dumped in the Equifax breach a couple years ago if you had interacted with credit in anyway. It's one of those things that you just have to accept its out there and secure yourself the best you can, 2fa everywhere, password manager, don't re-use passwords, etc. Most of that info is most dangerous when it can be used to break into a weaker account that may be used as auth for a stronger account, like T-Mo redirecting your 2fa texts to an attacker that paid off a customer support agent to sim swap your number. Your phone line is a huge security liability because of 2fa texts and the lax policies around line transfers. And this basically extends to any server, if they can get into your email, they can get into any account that uses your email as auth.

jghn 5y ago
The thing I haven't been able to figure out, once reaching the mental place you describe above, was what to do about it. It really feels like the answer is "do nothing, and hope no one ruins your life". Which isn't a great place to be.
- Ironlink 5y ago
  I guess the only course of action would be to work to make the leaked information out of date. You could change your name and address. Personally, I would not pursue that option.
- chris37879 5y ago
  I really wish I had a better answer for you, but I'm stuck there myself. Short of major reform that those that profit off this shit will just lobby away, there's literally nothing we can do but wait for the current notion of credit to collapse, unfortunately.

com2kid 5y ago

I live in Washington State, where up until recently, birth records for anyone could be requested by anyone. Address? If you own a home, already a matter of public record. Phone #, not secret at all (heck it is part of many people's email signatures!) Talk to an investigative journalist some time and find out exactly what info can be had publicly. On a related topic, a few years back I went to a presentation from a member of TMO's marketing team. They mentioned how they used a ad-tech company to real time query the mortgage status of people who visited TMO's homepage in order to help dynamically determine what line of phones to show. Live in a nice neighborhood and didn't have a bunch of late payments? iPhones showed up. To be clear, their is a vendor out there with an API that offers up, in real time, what your current mortgage status is. "You" of course are determined by a bunch of other web trackers. A few weeks ago Best Buy sold off the the fact that I was in their store looking at robotic vacuum cleaners. (Either that or some app on my phone was using really good location tracking, but Android has seriously cut down on that, AFAIK background apps aren't granular enough anymore to get section-in-store data) While I was impressed with the ad tech that made that level of targeting possible, it also means I am not likely to step inside a best buy again.

techrat 5y ago
Have you noticed that in Best Buy stores their price tags are now all eink paper? If they can 'electronify' a price tag, you know they have some precise beacons in that store.
- deleted 5y ago
  [deleted]
ROARosen 5y ago
Could be ultrasonic tracking beacons, see here: https://www.wired.com/2017/05/hundreds-apps-can-listen-beacons-cant-hear/ https://www.wired.com/2017/05/hundreds-apps-can-listen-beaco...
zxcvbn4038 5y ago
I can always tell what my wife is buying for my birthday, I get ads for the stuff she searches for even though we do not share devices, Google seems to make associations from the IP address. I watched a video review of a drone on YouTube and that was a huge mistake, got slammed with drone ads for weeks afterwards. Watching any video mentioning “Planet X” seems to sign you up for a semi truck full of crazy also.

SkyMarshal 5y ago

> Should I get a new number and replace my number at all services that use this number? Here's a guide to removing your phone number from all security functions: https://blog.kraken.com/post/219/security-advisory-mobile-phones/ https://blog.kraken.com/post/219/security-advisory-mobile-ph... Just made a separate post about it here, since it doesn't appear to have been posted at HN before: https://news.ycombinator.com/edit?id=28283321 https://news.ycombinator.com/edit?id=28283321

neither_color 5y ago
Thank you, this is very useful info.