9 ms·
T-Mobile says investigating data breach involving 37M accounts
- factsarelolz 4y agoI was a happy customer of T-Mobile for around 10 years. Until I moved out into the county and was forced to switch. It seems like temblor has gone down hill since acquiring sprint. But this isn't the first time something like this has happened at T-Mobile. Seems as if they have a 2-3 year cadence of data incidents.
- smm11 4y agoThis. I was a TMo customer from when they were Voicestream until about five years ago, then again 3 years ago. Had to switch to VZW so the college kids got signal. This is what, the third or fourth time they've had a data breach? We will not be going back. Ever.
- doodlebugging 4y agoIt starts to look like these are not breaches but instead could be sales of customer account info by insiders that are then reported as breaches by external bad actors. This is far too regular an occurrence for T-Mobile. I have never been a customer of theirs and so far as I know my info has never leaked from my cell provider. Unfortunately I was caught up in more than one other major data breach over the last 10 years so it is all out there but still, when one company has this many similar breaches it starts to look like planned events.
- arkadiyt 4y agoNot linked from the article but here is the filing T-mobile made with the SEC about it: https://www.sec.gov/Archives/edgar/data/1283699/000119312523010949/d641142d8k.htm https://www.sec.gov/Archives/edgar/data/1283699/000119312523...
- Entinel 4y ago>The company said it identified malicious activity on Jan. 5 and contained it within a day, adding that no sensitive data such as financial information was compromised. > However, some basic customer information was obtained, such as name, billing address, email and phone number, T-Mobile said. Is this not sensitive information? That all qualifies as PII.
- hunter2_ 4y agoPlus, another article [0] goes on to add "dates of birth, T-Mobile account numbers and information describing the kind of service they have" which gets me wondering about social engineering against CSRs, leading to a wave of SIM hijacking and the like. [0] https://www.cnn.com/2023/01/19/tech/tmobile-hack/index.html https://www.cnn.com/2023/01/19/tech/tmobile-hack/index.html
- alexriddle 4y agoIn the UK (arising from GDPR so I would assume EU as well), sensitive personal data is an enhanced category of PII which requires more considered handling. This would include things like race, health conditions, disabilities, sexual orientation, political views - basically things that you wouldn't expect T-Mobile to be storing.
- orhmeh09 4y agoIt is all PII. At the same time, all of this is often readily available for free from local government websites — this data and more are present for anyone who registers to vote in Seattle (maybe King County?), in a downloadable spreadsheet. I hate that this information is out there. For most of us it’s one in a series of unwanted disclosures. I care and disapprove on principle but I don’t think I’m compromised any more than I already am.
- sedatk 4y ago> Is this not sensitive information? Not after T-Mobile breach.
- jackcosgrove 4y agoIn these breaches there always seem to be two tiers of data, sensitive data that remains secure and less sensitive data that is leaked. This shows to me that companies are capable of securing sensitive data in most cases, and don't care as much about less sensitive data (even if it is PII). Maybe all data should be encrypted at rest, in transit, etc. and not just passwords, socials, and credit card numbers.
- deleted 4y ago[deleted]
- hedora 4y agoI'm tired of this crap. Can we just say all businesses have to pay $10,000 direct to each customer for each data breach? Furthermore, to prevent government scope creep, can we say the $10,000 comes from the dynastic wealth of whatever congress critters backed whatever bills required the companies to collect the stolen data in the first place? There is no reason for the cell company to even know who its customers are, beyond dealing with sim card replacements. That could be handled without requiring PII.
- deleted 4y ago[deleted]
- bushbaba 4y agoEven if just a $10/customer fine it’d still be massive. That’s 370M.
- hedora 4y agoIt needs to be company ending, and it needs to be owed to the customers so that the courts cannot negotiate it down (preferably, it would be first priority when apportioning company assets in any bankruptcy proceedings). That would force them to price out insurance policies, and then decide if paying $2500/yr per customer (since TMO has a breach like this every few years…) is greater than or less than the value the get from the data in the first place.
- voytec 4y agoSounds like a good incentive for better protection of user data in the future.
- inetknght 4y ago> Even if just a $10/customer fine it’d still be massive. Yes, exactly. It's indeed a massive value that's been stolen from the customers.
- lotsofpulp 4y agoThe other necessary fix here is making lenders liable for not verifying the identity of a borrower. Individuals should not have to spend time proving they did not borrow money, lenders should be liable for any losses if they want to save money and extend credit with just a SSN/name/address verification.
- knodi 4y agoNo wonder as a TMobile user I been getting daily spam.
- fortran77 4y agoMy 89-year-old mother uses a T-mobile prepaid plan on her flip phone. A text message that addresses her by name might fool her into getting phished. Plenty of “personal information״ has leaked.
- SoftTalker 4y agoI have an AT&T plan. I get lots of message claiming to be from AT&T, all get ignored and blocked. I don't trust any message from anyone not in my address book. Even then, sender can be spoofed, but it's less likely.
- fortran77 4y agoYeah, but my mother is incapable of managing an address book or using a smartphone with those types of features. In the past I told her to ignore every text message no matter how urgent or convincing it looks. Fortunately, she can't figure out how to read old messages so once a message times out and disappears from the screen she won't see it again.
- stygiansonic 4y agoPrevious settlement for a previous t mobile data breach: https://www.t-mobilesettlement.com/ https://www.t-mobilesettlement.com/
- adrianmonk 4y agoAgain? BTW, if you were in the previous breach, the deadline for making a claim under the class action settlement is in 4 days (January 23, 2023): https://www.t-mobilesettlement.com/ https://www.t-mobilesettlement.com/ You get $25 or actual damages with documentation. (Californians get $100 instead of $25 because of some law.) As part of this settlement, T-Mobile is also agreeing to spend an extra $150 million on information security during 2022 and 2023. I guess that money didn't get spent yet or it didn't work. (See section 5 in the actual agreement at https://www.t-mobilesettlement.com/home/1552/DocumentHandler?docPath=/Documents/Exhibit_1_Class_Action_Settlement_Agreement_and_Release.pdf https://www.t-mobilesettlement.com/home/1552/DocumentHandler...)
- SoftTalker 4y ago> T-Mobile is also agreeing to spend an extra $150 million on information security Well, some consultants are getting paid. Not so much the people who were actually harmed.
- deleted 4y ago[deleted]
- redtriumph 4y ago> "Our investigation is still ongoing, but the malicious activity appears to be fully contained at this time, and there is currently no evidence that the bad actor was able to breach or compromise our systems or our network" Why do companies always try to sugarcoat things? Its analogous to doctor gives us bad news but shows us the silver-lining. I guess these are more of the PR side of things.
- lynx23 4y agoIts all about the money. Can you name a single company that is proofable totally honest when it comes to describing its own failings?
- californical 4y agoDefinitely not an endorsement since I’m not an expert on the company, but I recall Cloudflare giving incredibly honest and transparent write-ups when they’ve had service issues in the past.
- encryptluks2 4y agoBecause we let them get away with it.
- zonethundery 4y agoThe target for the communication is investors. I read it to say "Price in the costs for a garden variety data breach, but not a CPRA-specific class action."
- red-iron-pine 4y agoBingo. The average T-Mobile user doesn't really understand what a breach is, and the handful of network engineer / tech nerds here on HN getting angry about it is superfluous to their bottom line. They're talking to investors, and maybe ISP Peers.
- voytec 4y agoData breach and unlawful data processing penalties should be painful so lack of investments in security would mean something more than just momentary bad press. It should REALLY hurt. Like strong financial penalties and CEO going to jail-hurt or at least board of directors throwing the CEO on the pavement-hurt. For now, it's just a potential slap-on-the-wrist cost of doing business which companies like T-Mobile or Google are very happy to risk time and again.
- MR4D 4y ago> and CEO going to jail… So, a CEO runs a company which uses another company to host their servers which uses an operating system built by another company, and runs on hardware built by yet another company and has a processor built by another company yet again. Every one of those is a potential security hole. Now who do you want to send to jail again? I get it, it’s frustrating. But the reason we haven’t solved this problem is because it’s both complicated and complex.
- voytec 4y ago> Now who do you want to send to jail again? People responsible for making decisions - usually holding a title of CxO. Judges are not unreasonable - if a CEO is responsible for cutting corners on security spending, it's something different than a faulty hardware (say, intel CPUs) which "everyone" uses.
- MR4D 4y agoEverything short of perfect security involves cutting corners - if nowhere else, then in the dimension of time. Mostly we call those trade offs, with this huge gray area where we argue about whether something is a trade off or unreasonably cutting corners. Again, these are difficult problems to address. The social aspect of getting humans to agree on something like this is hard.
- harikb 4y agoI agree. unless the one who stole the data comes and lays out the exact preventable vulnerability they exploited, this is just going to result in businesses paying through the roof for fake assurances of security from middlemen, indirectly passing the cost on to consumers/society.
- kitanata 4y agoFine them $1500 per account breached, per PII attribute taken. From the other posts it looks like at least 4 attributes were taken. So that is $1500 x 4 x 37M = $222B. I think $222B is a paltry sum compared to the amount of damage that was probably caused by this, but let’s settle for $222B anyway. Breaches like this should end the company forever and the C-Suite should go to prison for criminal negligence. I am sick and tired of this.
- alar44 4y agoAlright, sure. But you need to prove negligence. It's impossible to write perfect code right? You really have to prove whatever breach/error happened wasn't on purpose and wasn't due to gross negligence.
- azemetre 4y agoImagine a world where all software is written using formal methods [1], that would be heaven. [1] https://en.wikipedia.org/wiki/Formal_methods https://en.wikipedia.org/wiki/Formal_methods
- yjftsjthsd-h 4y agoHeaven if you like living in a world where it takes months to ship even simple software. Don't get me wrong, I think we're too sloppy most of the time, but it's a trade off, not one sided.
- namaria 4y agoMaybe it's not such a good idea to run so much critical stuff through systems built in weeks...
- yjftsjthsd-h 4y agoI was responding to > Imagine a world where all software is written using formal methods (emphasis mine) I would be much more agreeable to enforcing higher quality for more important things, including ex. systems that store PII for large numbers of people.
- bmarquez 4y agoLast major T-mobile hack was 2 years ago: https://news.ycombinator.com/item?id=28202399 https://news.ycombinator.com/item?id=28202399 Already had to freeze my credit reports because of last time, this new breach is ridiculous.
- SkyMarshal 4y agoCalling T-mobile’s security “ludicrous” would be a compliment. For a company with their resources, especially after multi-billion $ injection from ATT’s failed merger, they are so bad at it, it’s inconceivable. I don’t know who they’re hiring or contracting with to secure their systems and design their protocols, but they are garbage.
- namaria 4y agoSo much of enterprise level 'cybersecurity' is a box ticking exercise on one side and snake oil selling on the other. I have seen so many 'security products' presentations where you basically just tag resources versions and scan the tags, it's such an obvious scam. But the GUI looks awesome and they use 'AI'! sight It's all just a big compliance and cost x benefit balance act. We won't get any real security at scale until damages actually hurt insurers enough that they actually invest in understanding and mitigating the problems.
- SkyMarshal 4y agoThat's exactly my impression of what's going on at T-mobile. With the ATT settlement they could have hired the best from security research community and/or the whitehat community to design and implement world class systems, protocols, and procedures - Apple and Google level stuff. But they seem to instead be doing exactly what you describe.
- kjellsbells 4y agoNot defending t-mobile here, but perhaps the local talent pool wasn't interested in solving security problems for a telco when just up the street either of AWS or MSFT could give them planet scale security problems to sink their teeth into.
- beart 4y agoI do not have much of an internet presence at all - no facebook, instagram, whatsapp, etc. However, my entire identity has been leaked several times over from this and other leaks. Even if I never signed up for anything online at all, I'm still screwed from the credit bureau leaks. This issue is my "abortion" issue. What I mean is, I don't care who the candidate is, how immoral or unlikable they are. If they run punishing companies for data leaks, I will vote for them instantly.
- forgotmypw17 4y agoI think this type of legislation will be about as helpful as punishing a toddler for falling over. The root issue is that we are complacently pretending that any entity is capable of ensuring long-term security of a million-datapoint database of valuable information while at the same time thousands of their employees are allowed to work with it.
- fbdab103 4y agoGenuine question, how many big leaks have Facebook, Microsoft, Google, Apple, etc experienced? If even companies paying top tier rates cannot manage the problem, I am unsure what recourse there is.
- progman32 4y agoWell, right now there is no particularly strong incentive to perform well in this area for anyone (FAANG included), so I'm not sure past performance is indicative of future performance under a hypothetical ultra-strict punishment-happy regime.
- carom 4y agoYes to the second part, no to the first part. Let's punish these entities until the cost of storing (and leaking) my personal data is too high for them to stomach.
- T-Winsnes 4y agoI tend to disagree, it's risk based. If it's incredibly expensive to get it wrong, you start weighing up if it's worth storing all that data.
- JiNCMG 4y agoNever used T-Mobile, yet the last T-Mobile breach, I received a postcard from them offering me credit security services because they leaked my information. Turns out that data was from the early 2000's when cell phone store employee checked to see what services I can apply for... WTF!
- jpease 4y ago“name, billing address, email and phone number” Most of that used to be published in print and sent out to everyone. Do they still make phoneboks?
- dheera 4y ago"adding that no sensitive data such as financial information was compromised" "some basic customer information was obtained, such as name, billing address" Yeah THIS is why I vehemently disagree with KYC laws, especially those requiring a street address. I shouldn't have to tell someone where I sleep to use their business. Breaches like this enable stalkers, thieves, domestic violence, lots of bad things.
- JohnTHaller 4y agoOh goody. I just finished dealing with identity theft from the last T-Mobile breach.
- joshmn 4y agoOh good, abused via an API. /s Over the last 24 months, I have seen some weird increasing rate of vulnerable API endpoints in my own research. One of which would allow a bad actor direct access to over $2BB in funds (from a major organization worth more than $10BB), another plain-text credit card numbers and billing addresses (same application as the first); another were more plain-text credit card numbers (much smaller org, but still sizable). Both attacks were alarmingly non-trivial and would be scored as critical. Why this trend is seemingly increasing, I don't know.
- SentientAtom 4y agoProgrammed in-house, contracted domestically, or outsourced overseas?
- joshmn 4y agoThe second shop was definitely outsourced. The first was probably a mix of both. Regardless it shouldn't have happened.
- finickydesert 4y agoWhy don't they just start fining the c level execs directly, in addition to increasing fines?
- jgaa 4y agoOr even better; by federal law, cancel all bonuses, stock buyback and dividend for 3 years, for any company that leaked data about any person, anywhere in the world trough a data breach. And fine them accordingly, so the saved money don't just pile up for a late pack-back 3 years later. That should fix the problem.
- rayrey 4y agoCool I am up to 22 years of free credit monitoring, maybe I can make it 25
- shawn-butler 4y agoDoes it actually do anything positive for you? Credit monitoring always seemed to me like a scam ala antivirus, but in all fairness I have never purchased it either.
- bigmattystyles 4y agoIt is a scam - on multiple levels - first you get credit monitoring, but to the companies, it's a sales lead to try to sell you more of their protection / reports. It'd be a shame if something were to happen to your credit score. Second, if a financial institution lent money to someone pretending to be me and this damages the rating these credit bureaus assign to me, why do I have to get involved? We have, as a society, let these companies get away with making us believe their lack of due diligence is our fault. I don't know enough about the law to know why we can't sue these companies for libel.
- gundamdoubleO 4y ago> "no sensitive data such as financial information was compromised." > "some basic customer information was obtained, such as name, billing address, email and phone number" Yup definitely no sensitive data there
- SkyMarshal 4y agoTo be honest, my name, billing address, email, and phone number have been compromised so many times by so many companies by now that I just don’t care any more. I’m about to do my once-a-decade phone number switch anyway. As long as my password/hash and payment info wasn’t compromised, that’s the main thing I care about.
- swarnie 4y agoIsn't it a bit sad that we've got to this point?
- SkyMarshal 4y agoYup.
- leeches 4y agoWhen there are little to no consequences, it will keep happening. We need severe penalties for losing sensitive data, as in, an actual threat to the survival of a company, not some minuscule fine.
- reustle 4y agoI don't disagree that this is sensitive, but isn't it wild to think that only 15 years ago, Yellow Pages was sending directories of name, address, and phone number of everyone in your area.
- tatersolid 4y agoThe book with people’s names, addresses, and phone numbers was the “white pages” or simply “phone book”. The book with business numbers and ads was the Yellow Pages. Get off my lawn.
- rvz 4y agoIn this breach it looks like it has extremely sensitive information there enough for identity theft and fraud. Let alone easy SIM swapping attacks. > However, some basic customer information was obtained, such as name, billing address, email and phone number, T-Mobile said. This isn't even the first time they got breached and yet it has happened again. They have not learned anything. I think it is time that we stop using phone numbers as a login mechanism. It has always been a completely stupid idea from the beginning of its use. Let the SIM swapping attacks and identity theft games begin.
- encryptluks2 4y agoNow do Comcast Xfinity. They've been leaking customer information for years without ever disclosing it.
- spicymaki 4y agoIs this different from the last breach?
- LinuxBender 4y agoDoes this potentially also affect their MVNO resellers?