T-Mobile has announced a data breach exposing customers’ proprietary network information (CPNI), including phone numbers and call records.
Starting yesterday, T-Mobile began texting customers that a “security incident” exposed their account’s information.
According to T-Mobile, its security team recently discovered “malicious, unauthorized access” to their systems. After bringing in a cybersecurity firm to perform an investigation, T-Mobile found that threat actors gained access to the telecommunications information generated by customers, known as CPNI.
The information exposed in this breach includes phone numbers, call records, and the number of lines on an account.
“Customer proprietary network information (CPNI) as defined by the Federal Communications Commission (FCC) rules was accessed. The CPNI accessed may have included phone number, number of lines subscribed to on your account and, in some cases, call-related information collected as part of the normal operation of your wireless service,” T-Mobile stated in a data breach notification.
T-Mobile states that the data breach did not expose account holders’ names, physical addresses, email addresses, financial data, credit card information, social security numbers, tax IDs, passwords, or PINs.
In a statement to BleepingComputer, T-Mobile stated that this breach affected a “small number of customers (less than 0.2%).” T-Mobile has approximately 100 million customers, which equates to around 200,000 people affected by this breach.
“We are currently notifying a small number of customers (less than 0.2%) that some information related to their account may have been illegally accessed. The data accessed did NOT include any names associated with the account, financial data, credit card information, social security numbers, passwords, PINs or physical or email addresses. The information that was accessed may have included phone numbers, number of lines subscribed to and in a small number of cases some call-related information collected as part of normal operation and service,” T-Mobile told BleepingComputer.
Those who received the text alert about this breach should be on the lookout for suspicious texts claiming to be from T-Mobile asking for information or containing links to non-T-Mobile web pages.
It is not uncommon for threat actors to use stolen information for further targeted phishing/smishing campaigns that attempt to steal sensitive information such as login names and passwords.
T-Mobile previously suffered from breaches in 2018 that exposed customers’ information, 2019 for prepaid customers, and in March 2020 that exposed customer and financial data.
From: Bleeping Computer