T-Mobile CEO Apologizes For Data Breach Affecting Over 53 Million Users (nbcnews.com) 26
"T-Mobile CEO Mike Sievert published an open apology to customers Friday after hackers stole more than 50 million users' personal data, including their Social Security numbers and driver's license information," reports NBC News:
"The last two weeks have been humbling for all of us at T-Mobile," he wrote. "To say we are disappointed and frustrated that this happened is an understatement."
The incident is the fourth known breach at T-Mobile since 2018, and by far the largest. The full count of how many customers had their data stolen is unclear, but the company said last week it had identified more than 53 million affected customers, most of them on subscription plans. It also included an unspecified number of "prospective" users who are not T-Mobile customers...
It is unclear why T-Mobile was storing customers' driver's license information and Social Security numbers without encrypting them in a way that would make it difficult or impossible for hackers to see them even if they stole them. Jackie Singh, a cybersecurity consultant, said it was irresponsible on the part of T-Mobile, especially for hard-to-change sensitive personal data like Social Security numbers.
"It is frankly bizarre to learn that in this day and age, a major telco continues to store critical customer data in plain text," she said. "Offering two years of credit monitoring services doesn't change the fact that harm was done to their customer base."
NBC says they spoke to the person identified as the perpetrator by the Wall Street Journal, who told them last week that he'd planned to sell the information on more than 100 million users for a hefty profit.
Meanwhile, T-Mobile's CEO now says they're alerting affected users and have set up a hub for victim services. Beneath the words "NOTICE OF DATA BREACH," it adds the tagline "Keeping you safe from cybersecurity threats. What you need to know and how we're protecting you."
The incident is the fourth known breach at T-Mobile since 2018, and by far the largest. The full count of how many customers had their data stolen is unclear, but the company said last week it had identified more than 53 million affected customers, most of them on subscription plans. It also included an unspecified number of "prospective" users who are not T-Mobile customers...
It is unclear why T-Mobile was storing customers' driver's license information and Social Security numbers without encrypting them in a way that would make it difficult or impossible for hackers to see them even if they stole them. Jackie Singh, a cybersecurity consultant, said it was irresponsible on the part of T-Mobile, especially for hard-to-change sensitive personal data like Social Security numbers.
"It is frankly bizarre to learn that in this day and age, a major telco continues to store critical customer data in plain text," she said. "Offering two years of credit monitoring services doesn't change the fact that harm was done to their customer base."
NBC says they spoke to the person identified as the perpetrator by the Wall Street Journal, who told them last week that he'd planned to sell the information on more than 100 million users for a hefty profit.
Meanwhile, T-Mobile's CEO now says they're alerting affected users and have set up a hub for victim services. Beneath the words "NOTICE OF DATA BREACH," it adds the tagline "Keeping you safe from cybersecurity threats. What you need to know and how we're protecting you."
a hub for victim services (Score:2)
Victim Services. Now if that's not a great band name, what is?
Re: (Score:2)
Re: (Score:2)
there are only three mobile phone providers in the U.S. now, so there aren't a lot of alternatives to T-Mobile.
I use a T-Mobile MVNO. I use their network, but T-Mobile doesn't have my data for a hacker to steal.
Re: (Score:2)
Because apologizes are cheap (Score:2)
Re: (Score:2)
It's sad that in 2021 the US still doesn't seem to have significant legal penalties for businesses that cause such large personal data leaks apparently through basic security failures.
If a breach of this scale, involving data of this significance happened in Europe, and if it really was caused by a negligent failure to apply basic security and data protection measures, potential fines with nine figures would be on the table.
$10,000 per victim seems reasonable (Score:4, Insightful)
Oh - does that make your company bankrupt? What a shame. I suggest you sue your auditors for not asking the right questions about the IT security regime...
Re: $10,000 per victim seems reasonable (Score:2)
Don't forget to add 'plus documented customer losses' so if the customer has lost $10 million it must be covered.
Also add shareholder responsibility in cases like these.
Re: (Score:1)
They're sorry (Score:2)
Re: (Score:2)
Pretty much this. Saying sorry doesn't cost a thing and doesn't help any of the victims.
Re: (Score:2)
You can tell if a company is virtue signalling or not by the pricetag attached to what they just did.
Apologies are nice... (Score:2)
Should notify the credit rating agencies (Score:5, Interesting)
Instead of going after lax security at T-Mobile, lets work to make the information stolen useless to commit fraud. Let T-Mobile ask for consent from its users and formally tell all the credit reporting agencies,
"The identity of the following person has been compromised. Any lender going after this person should prove the borrower is this real person, not some fraudster. The customer is giving legal announcement if any lender sues them wrongfully, they need to bear the entire cost of defense".
Sue a few lenders on behalf its customers who become victims of identity theft and get a precedent setting ruling.
Re: Should notify the credit rating agencies (Score:1)
Re: Should notify the credit rating agencies (Score:1)
Re: (Score:2)
The information stolen should not be this valuable. We can not fix the security in every company that knows our name, address and may be social security number. We need to make that information worthless. That is the way to protect us from ALL possible security lapses regarding identity. Taking T-Mobile to task and blaming is playing whack-a-mole. That's what the big banks and lenders want us to do. So that they get the marginal benefit of making loan for an im
It all gets back to the credit industry (Score:2)
Re: (Score:2)
One wonders if this was posted as earnest spam, or as an attempt to slashdot the website, or by some SEO nerd who claimed that for $$$ they could "drive millions of hits" to the site. In any case, we need a way to convert spam links to goatse.
LOL ... NOT (Score:3)
Just recently switched too (Score:1)
I switched to t mobile recently out of frustration from smaller carriers having spotty coverage. I've tried a bunch of smaller alternative carriers but have had problems getting signal sometimes in places that are city centers.
I figured going to a big carrier would fix that problem. It definitely did. And now I have a new problem, which is likely identity theft. What a great onboarding package.
Not all that uncommon⦠(Score:1)
Let me guess (Score:2)
The hackers were "exceptionally skilled" and got the data through "highly advanced techniques".
"Security is our top priority", and "we take protecting our customers' data very seriously".
We have "engaged a top security firm" and "taken steps to ensure this doesn't happen again".
Did I miss any?