3 ms·

T-Mobile pays $16M fine for three years' worth of data breaches

60 points by pseudolus 2y ago

mmh0000 2y ago
If I'm not terrible at my math... T-Mobile earned $8 billion in 2023. Some division later, that works out to $21,000,000 per day. They were fined less than one day's income. If I owned that company, increasing IT security would be near the bottom of my list of priorities.
- focusedone 2y ago
  FCC: "That'll teach 'em"
  - freedomben 2y ago
    My guess is that the FCC doesn't have a ton of discretion here. They probably have to follow the law. And no doubt an "unreasonbly" large fine would be challenged in court and probably overturned, so this may be the best they can do.
    - outside1234 2y ago
      And/or lobbying has made the fines very small
- freedomben 2y ago
  Is the $8B profit or revenue? To your point, $16M is surely not a big fine for such a big company though, but I do think it's important not conflate profit and revenue when evaluating fines. Generally speaking, I would love to see some much harsher penalties for negligence with data. I want companies to start seeing customer data as a liability, not as an asset, and I don't think that will happen until f**k-ups starts really making a dent in the bank account.
  - Wytwwww 2y ago
    > Is the $8B profit or revenue? Profit, their revenue is almost 80 billion. Fines like this should be certainly based on revenue rather than profit, though (like the EU does it)
    - freedomben 2y ago
      Why should they be based on revenue rather than profit? (I'm not disagreeing, interested to understand your reasoning)
      - c0wb0yc0d3r 2y ago
        No the person you were replying to, but my reason is that revenue is before expenses. The fine actually has to cost the company money for it to mean anything.
      - supertrope 2y ago
        Businesses can strategically reduce taxable income. Gross revenue is less malleable.
  - blackeyeblitzar 2y ago
    It’s $8.3B in net income (so profit) - see slide 4 in this PDF: https://s29.q4cdn.com/310188824/files/doc_financials/2023/ar/TMUS-2023-Annual-Report.pdf https://s29.q4cdn.com/310188824/files/doc_financials/2023/ar...
  - default-kramer 2y ago
    I still think the C-suite won't care unless the cleanup/penalty costs get pulled directly from their bonus before anywhere else. Otherwise it will just be "oops, I tanked this business, better luck at the next one."
- notinmykernel 2y ago
  As part of the agreement, TMobile has to harden IT security and show proof (e.g., CISO who reports regularly to feds, adoption of Zero Trust, adoption of minimal data retention policy). Why TMobile must have their hand held like this is beyond me.
  - beefok 2y ago
    AND we get increased monthly bills to pay for the cost of their fuckups.
  - AdmiralAsshat 2y ago
    And if T-Mobile fails to live up to their end of the agreement, what's the punishment? More meaningless fines?
- jrwoodruff 2y ago
  The equivalent of about $200 for someone making $100,000/yr
brutal_chaos_ 2y ago
What a joke. Why would they stop? The US needs privacy as a right for its citizens. This is so disheartening.
ChrisArchitect 2y ago
Official FCC release: https://www.fcc.gov/document/t-mobile-required-change-business-practices-after-data-breaches-0 https://www.fcc.gov/document/t-mobile-required-change-busine...
doodlebugging 2y ago
These "breaches" are such a regular occurrence for T-Mobile that one could suppose that they are intentional and that T-Mobile may be getting paid for the data, kinda like a side hustle, where they constantly troll for n00b customers who either haven't been part of a previous breach or who have managed to lay aside their disgust and take the low price deal so they can get pwned again. If I ran the show I'd bankrupt the company and its management. Never attribute an unfortunate outcome to incompetence when the possibility exists that it was caused by greed.
- ranger_danger 2y ago
  plot twist, the buyer is a world government and it's a psyop /s
beefok 2y ago
Why the fuck do we have to give out our personal information to any of these big companies if I can't trust that it will ever be safe-guarded? This is just so fucking insane to me to think these companies are just so big that they don't even give a fuck anymore. $16M is equivalent to $1.00 to them. Our personal information/data should be given HIPAA-level protection enforced by the government. We as consumers should not have to deal with companies who do not compete on securing their customer's data. They should lose a "data protection" license when mishandling it, like a bar losing its liquor license.
- supertrope 2y ago
  This is a reason to get service through a MVNO. No Social Security Number required means no SSN to leak.
- lapphi 2y ago
  Because we are “free” to “choose” who we do business with. Nevermind that many essential services are run by legal cartels. And Tmobile has more lobbyists than you do. But you, an individual, are also “free” to lobby the government as much as you wish. Thusly, the system is fair and balanced on paper.

60 points by pseudolus 2y ago

If I'm not terrible at my math... T-Mobile earned $8 billion in 2023. Some division later, that works out to $21,000,000 per day. They were fined less than one day's income. If I owned that company, increasing IT security would be near the bottom of my list of priorities.

focusedone 2y ago
FCC: "That'll teach 'em"
- freedomben 2y ago
  My guess is that the FCC doesn't have a ton of discretion here. They probably have to follow the law. And no doubt an "unreasonbly" large fine would be challenged in court and probably overturned, so this may be the best they can do.
  - outside1234 2y ago
    And/or lobbying has made the fines very small
freedomben 2y ago
Is the $8B profit or revenue? To your point, $16M is surely not a big fine for such a big company though, but I do think it's important not conflate profit and revenue when evaluating fines. Generally speaking, I would love to see some much harsher penalties for negligence with data. I want companies to start seeing customer data as a liability, not as an asset, and I don't think that will happen until f**k-ups starts really making a dent in the bank account.
- Wytwwww 2y ago
  > Is the $8B profit or revenue? Profit, their revenue is almost 80 billion. Fines like this should be certainly based on revenue rather than profit, though (like the EU does it)
  - freedomben 2y ago
    Why should they be based on revenue rather than profit? (I'm not disagreeing, interested to understand your reasoning)
    - c0wb0yc0d3r 2y ago
      No the person you were replying to, but my reason is that revenue is before expenses. The fine actually has to cost the company money for it to mean anything.
    - supertrope 2y ago
      Businesses can strategically reduce taxable income. Gross revenue is less malleable.
- blackeyeblitzar 2y ago
  It’s $8.3B in net income (so profit) - see slide 4 in this PDF: https://s29.q4cdn.com/310188824/files/doc_financials/2023/ar/TMUS-2023-Annual-Report.pdf https://s29.q4cdn.com/310188824/files/doc_financials/2023/ar...
- default-kramer 2y ago
  I still think the C-suite won't care unless the cleanup/penalty costs get pulled directly from their bonus before anywhere else. Otherwise it will just be "oops, I tanked this business, better luck at the next one."
notinmykernel 2y ago
As part of the agreement, TMobile has to harden IT security and show proof (e.g., CISO who reports regularly to feds, adoption of Zero Trust, adoption of minimal data retention policy). Why TMobile must have their hand held like this is beyond me.
- beefok 2y ago
  AND we get increased monthly bills to pay for the cost of their fuckups.
- AdmiralAsshat 2y ago
  And if T-Mobile fails to live up to their end of the agreement, what's the punishment? More meaningless fines?
jrwoodruff 2y ago
The equivalent of about $200 for someone making $100,000/yr

brutal_chaos_ 2y ago

What a joke. Why would they stop? The US needs privacy as a right for its citizens. This is so disheartening.

ChrisArchitect 2y ago

Official FCC release: https://www.fcc.gov/document/t-mobile-required-change-business-practices-after-data-breaches-0 https://www.fcc.gov/document/t-mobile-required-change-busine...

doodlebugging 2y ago

These "breaches" are such a regular occurrence for T-Mobile that one could suppose that they are intentional and that T-Mobile may be getting paid for the data, kinda like a side hustle, where they constantly troll for n00b customers who either haven't been part of a previous breach or who have managed to lay aside their disgust and take the low price deal so they can get pwned again. If I ran the show I'd bankrupt the company and its management. Never attribute an unfortunate outcome to incompetence when the possibility exists that it was caused by greed.

ranger_danger 2y ago
plot twist, the buyer is a world government and it's a psyop /s

beefok 2y ago

Why the fuck do we have to give out our personal information to any of these big companies if I can't trust that it will ever be safe-guarded? This is just so fucking insane to me to think these companies are just so big that they don't even give a fuck anymore. $16M is equivalent to $1.00 to them. Our personal information/data should be given HIPAA-level protection enforced by the government. We as consumers should not have to deal with companies who do not compete on securing their customer's data. They should lose a "data protection" license when mishandling it, like a bar losing its liquor license.

supertrope 2y ago
This is a reason to get service through a MVNO. No Social Security Number required means no SSN to leak.
lapphi 2y ago
Because we are “free” to “choose” who we do business with. Nevermind that many essential services are run by legal cartels. And Tmobile has more lobbyists than you do. But you, an individual, are also “free” to lobby the government as much as you wish. Thusly, the system is fair and balanced on paper.