T-Mobile

T-Mobile US Inc. - as of August 2021, the second largest American telecom operator owned by the German telecommunications company Deutsche Telekom.

History

2023

Customer Data Breach

The personal information customers German of the telecom operator T-Mobile got into the public domain. In particular, names, phone numbers, addresses, data account balances, as well as information bank cards from the operator's clients were publicly available. This was reported on September 26 in the press service of the deputy. State Dumas RUSSIAN FEDERATION Anton Nemkin

As noted, for two weeks the company ignored user complaints, after which it made a statement so that the system would fail.

There was no cyberattack or hacking at T-Mobile. It was a temporary system failure related to a planned overnight technology update involving the release of limited account information to fewer than 100 customers, the company said.

The issue was quickly fixed, T-Mobile said in a statement.

Reduction of 7% of the state

On August 24, 2023, the mobile operator T-Mobile in the United States announced its intention to carry out a restructuring, in which the number of personnel will be reduced by about 7%.

It is reported that T-Mobile is experiencing financial difficulties in the current macroeconomic situation and crisis. The company's revenue is falling, and the growth rate of the subscriber base is slowing. Against this background, the operator is forced to lay off approximately 5,000 employees. The cuts will affect primarily employees of corporate and auxiliary offices throughout the United States. In addition, certain technical positions will be abolished. At the same time, layoffs are not planned in the retail and customer service divisions.

Operator forced to lay off roughly 5,000 employees

The tasks that need to be completed to attract and retain customers cost significantly more than only a few quarters ago [as of the third quarter of 2023]. This is a significant restructuring, which is unusual for our company. Additional large-scale cuts are not planned for the foreseeable future, "said T-Mobile CEO Michael Sievert.

According to the operator's estimates, in the third quarter of 2023, it will register expenses before taxes in the amount of about $450 million related to job cuts. Dismissed employees will receive severance pay (the amount depends on the length of service), payment for a 60-day period, as well as assistance in employment in a new place and other benefits. As part of the reorganization, T-Mobile plans to cut costs in a number of areas of activity. These measures will help the company focus on key business development strategies, which is expected to provide positive dynamics in the long term.^[1]

Data breach of 37 million subscribers

On January 19, 2023, it became known that the data of about 37 million subscribers of the American mobile operator T-Mobile were stolen by hackers. The operator's systems were subjected to a hacker attack back in November 2022, but this became known only in January 2023.

The attackers managed to gain access to personal data of subscribers, including dates of birth, phone numbers and addresses. At the same time, passwords, secret codes, bank information, as well as data from government documents turned out to be intact. With the help of outside cybersecurity experts, mobile operator T-Mobile stopped the leak the next day, the company said.

There was a data leak of 37 million subscribers of the American operator T-Mobile

T-Mobile said there was no evidence its systems or network had been hacked, adding that the mechanism the hacker used did not provide access to more sensitive information such as Social Security numbers, government identification numbers, passwords or payment card details. The revealed information included names, billing and email addresses, phone numbers, dates of birth, T-Mobile account numbers, as well as data such as the number of lines on the account and features of the tariff plan. Many accounts did not contain all this data. According to T-Mobile, the company began notifying some of the affected customers in accordance with state and federal requirements.

T-Mobile said an investigation was ongoing by January 19, 2023, and federal authorities were notified of the incident. According to the Associated Press, the hacker first began receiving data on November 25, 2022 through an application programming interface - a common piece of code that allows software to interact with other programs. In a statement filed on January 19, 2023, T-Mobile reported that the company had "made substantial progress" in these improvements. She also admitted she could face "significant costs" as a result of the latest hack.^[2]

2022: $350m compensation to subscribers affected by data breach

At the end of July 2022, T-Mobile agreed to pay $350 million to customers affected by a personal data leak in August 2021 as a result of a cyber attack on the company. T-Mobile will spend an additional $150 million in 2023 to improve data security within the company.

According to the American weekly magazine Time, as a result of a cyber attack, information belonging to about 76.6 million people was compromised. The data leak occurred in August 2021, the T-Mobile customer database was put up for sale on the Internet. Hackers reported hacking into the operator's servers, including an Oracle server containing customer data. One of them explained that he was annoyed by the terrible level of security of the company. The hacker explained that he used the available pentest tools to hack into the company's internal network.

T-Mobile to pay $350 million to subscribers affected by data breach

The company estimates that less than 1 million accounts and PINs have been compromised. However, independent experts believe that the number of victims ranges from 40 million to 100 million users. In addition to Social Security numbers, other information was violated: names, surnames and driver's license and other identity cards. T-Mobile denies all wrongdoing, including allegations that the company breached its duty to protect customers' personal information and failed to ensure proper data security.

T-Mobile said in late July 2022 that the settlement did not include a finding of responsibility, wrongdoing or guilt of any of the defendants. The company said it expects the court to approve the terms of the settlement as early as December 2022. The proposed settlement must be approved by a judge and the company will then have 10 days to put the money into the fund. The settlement does not include estimates of how much each plaintiff can expect.^[3]

2021

Hackers steal data of 49 million company customers

In early August 2021, information appeared that a hacker sells personal data of 100 million T-Mobile customers in the United States, claiming that we are talking about complete information about each client, including social security numbers.

According to information from Motherboard, the message itself on the forum does not mention T-Mobile that they managed to obtain data from T-Mobile servers. A competent representative of the publication saw the data samples and confirmed that they contain accurate information about the operator's clients.

The data are comprehensive and include: names, social security numbers, phone numbers, physical addresses, unique IMEI numbers, driver's license information.

Hacker sells data to 100 million T-Mobile customers

We are aware of statements or topics made on the underground forum and are actively investigating their validity. At the moment, we do not have any additional information to share it, "T-Mobile said in a statement.

The seller also told the technical director of Hudson Rock, Elon Gal, a cybercrime intelligence company, that this blow to US infrastructure was in retaliation for the abduction and torture of John Erin Binns (CIA Raven-1) in Germany by CIA and Turkish intelligence agents in 2019. This hack was made to damage US infrastructure.

In particular, cybercriminals claim that at the end of July 2021 they penetrated T-Mobile's production servers and development servers, including the Oracl e database server that stored customer data. As evidence of the theft, the seller shared a screenshot of an SSH connection to a production server running Oracle.

The hacker says that he sells most of the data privately, but can provide 30 million social security numbers and driver's license data for 6 bitcoins ($270 thousand).

T-Mobile did not confirm or deny this claim, the operator repeatedly refused to answer questions about the scale of the hack. ^[4]

Only on August 18, 2021, T-Mobile confirmed the theft by hackers of personal information of about 49 million customers, including potential ones.

The mobile operator said the stolen data includes first and last names, dates of birth, Social Security numbers and driver's license information.

Buying Shentel's Cell Business

In early February 2021, T-Mobile settled a dispute over the cost of acquiring the cell business of Shenandoah Telecommunications Company (Shentel). The final value of the transaction was $1.95 billion. Read more here.

Hacking of IT systems and theft of conversation records of 200 thousand subscribers

In early January 2021, T-Mobile reported its fourth data breach in the past three years. This time, as a result of hacking into the mobile operator's IT systems, hackers were able to access recordings of subscribers' conversations.

Our cybersecurity team recently discovered and blocked malicious unauthorized access to some information related to your T-Mobile account... We have engaged leading cybersecurity experts to clarify the circumstances of the incident. We also immediately notified law enforcement agencies and began to notify customers, the company said in a letter that it sent to its customers whose data was compromised.

As a result of hacking IT systems, records of conversations of 200 thousand subscribers were stolen from the American T-Mobile

As the investigation showed, cybercriminals gained access to customer data such as phone numbers and call history. The leak did not affect account names, physical or email addresses, financial data, passwords, social security numbers and TINs, T-Mobile claims.

The company did not disclose the exact number of subscribers whose personal data and conversations fell into the hands of unidentified persons. T-Mobile only told TechCrunch that "about 0.2%" of subscribers were affected. By the end of June 2020, the operator had about 98.3 million users (Statista.com statistics), so cybercriminals could steal data from about 200 thousand people.

As noted by the ZDNet portal, the consequences of the hack look not so serious compared to previous leaks due to the relatively small number of affected customers and the amount of stolen data. Thus, about 2 million T-Mobile subscribers became victims of the data leak registered in August 2018. There were also leaks in November 2019 and March 2020.^[5]

2018

T-Mobile buys Sprint for $26 billion

On April 29, 2018, T-Mobile and Sprint (ranked third and fourth on the list of the largest cellular operators in the United States) officially announced the merger. This is not the first attempt by companies to come together. Read more here.

US $40 million fine for cheating customers

In April 2018, the US representative office of T-Mobile was fined for false claims that the company provided high-quality communication to remote regions of the United States. Instead of improving its network, the operator chose to use a deceptive scheme. Its essence was explained by the US Federal Communications Commission (FCC).

During an outgoing call, the user of the phone hears beeps or a melody, which usually indicate that the call is coming, but the called party simply does not pick up the phone. But in the case of T-Mobile, there was an imitation of these sounds for the person making the outgoing call: the called subscriber did not hear any call, since his phone was out of range of the network.

T-Mobile will pay $40 million to simulate hundreds of millions of calls in villages

The FCC launched the investigation after T-Mobile customers began complaining about problems dialing subscribers to three carriers serving rural areas in Wisconsin. T-Mobile stated that the problem was solved, however, as it turned out, the telecommunications company resorted to simulating calls.

Such deception on the part of T-Mobile leads to a loss of income for rural enterprises, prevents ambulance calls, deprives families of communication with their loved ones and creates a danger associated with a lack of communications to ensure public safety, the regulator said in a statement.

It is alleged that the operator simulated hundreds of millions of calls coming to remote areas of the United States. T-Mobile pleaded guilty and agreed to pay a fine of $40 million in favor of the Ministry of Finance. The company called its actions "unintentional" and said they were terminated in January 2017.

At the same time, T-Mobile is not the first American mobile operator to be convicted of using false calls. In 2015, Verizon was fined $5 million in a similar proceeding.^[6]

Notes