T-Mobile has said in a regulatory filing that its most sensitive records such as credit card numbers, social security numbers, birth dates and billing addresses of about 37 million of its customers have been accessed by cyber hackers. Accordibng to the company, its systeks weren’t breached but someone was improperly obtaining data through application programming interface (API). In 2021, T-Mobile anounced another security lapse after personal ionformation regarding more than 50 million of its current, former and prospective customers was found for sale online. The estimate was later raised to 76.6 million U.S. residents.
This is the fifth disclosed breach of T-Mobile breach since 2018. Prior to the August 2021 intrusion, the company disclosed breaches in January 2021, November 2019 and August 2018 in which customer information was accessed.
The highly publicized incident in 2021 that comprised data on 76 million customers led the company to paying $350 million in a class action lawsuit settlement to lawyers and customers.
Regarding the most recent attack, Approov CEO Ted Miracco said all signs point to a state-sponsored attack based on the magnitude of data stolen and the period of time involved in exfiltrating the data. He said currently deployed security technologies in mobile applications “are just small speed bumps for the experienced hackers” that are increasingly using man-in-the-middle attacks (MitM) and API Keys to gather richer troves of data including the full range of not just PII.
Jeffrey Newman is a whistleblower lawyer that represents whistleblowers in the SEC whistleblower program as well as False Claims Act cases and he can be reached at 617-823-3217 or at jeff@jeffnewmanlaw.com
