T-Mobile has admitted that tens of millions of customers have had their personal and account information accessed via APIs by malicious actors.
The US mobile carrier explained in an SEC filing yesterday that the attack began “on or about” November 25, 2022, but was not discovered until January 5, 2023.
The information compromised by the threat actor included information such as customer names, billing and email addresses, phone numbers, dates of birth, T-Mobile account numbers, account line count and plan features. .
T-Mobile attempted to downplay the severity of the breach in a related statement, claiming that “nearly all” of the stolen information was “of the type widely available in marketing databases or directories.”
Such a large amount of data is a bit off the mark in that it provides a ready-made profile of each customer for fraudsters to use in subsequent phishing and identity fraud attempts.
“Passwords, payment card information, social security numbers, government ID numbers, or other financial account information were not compromised,” T-Mobile added in a statement.
“Our systems and policies have prevented access to the most sensitive types of customer information. As a result, customer accounts and finances should not be directly endangered by this event. There is also no evidence that any person has penetrated or compromised T-Mobile’s network or systems.”
It’s unclear what kind of API flaw the attackers exploited or why it took the carrier nearly a month and a half to detect the breach.
Wallarm CEO and co-founder Ivan Novikov argued that organizations should regularly review and update their security systems, policies and capabilities, and develop incident response plans.
“As organizations continue to accelerate their digital transformation efforts and leverage more and more APIs, it is critical that they have the right tools and expertise to protect sensitive data,” he said. Added.
“Unauthorized access through a single API can lead to a major data breach.”
Editorial Credit Icon Image: nikkimeel / Shutterstock.com
