Personal data of two million customers swiped in T-Mobile breach

AppleInsider

T-Mobile has confirmed it is the victim of a server breach where attackers accessed customer data, with the recently-discovered intrusion involving personal data potentially affecting as many as two million users of the major U.S. carrier.

A notice to customers on the T-Mobile website advises the carrier's cyber-security team "discovered and shut down an unauthorized access to certain information" on August 20. After discovering the breach, T-Mobile notes it "promptly reported it to authorities."

It is advised the breach did not involve the acquisition of financial data, including credit card information, nor did it compromise social security numbers or passwords. Of the data that has been exposed, T-Mobile states it may include a user's name, billing zip code, phone number, email address, account number, and whether it is a prepaid or postpaid account.

T-Mobile is currently in the process of notifying customers affected by the breach, and advises those with questions about the incident or their account to contact customer care. Customers who don't receive the notification are not affected by the attack, but are also encouraged to contact customer services with their queries.

While the exact number of customers affected by the breach has not been officially released, a company spokesperson told Motherboard it is "about" or "slightly less than" three percent of its 77 million customers. Hypothetically, if a full three percent of customers were affected, this would put the total number at approximately 2.31 million users.

The spokesperson advised the incident took place early on August 20, with the hackers believed to be part of an "international group," though it is unknown if the hackers are criminals or state-sponsored actors. Specifics of the attack were also not able to be provided, but the spokesperson claims "We found it quickly and shut it down very fast."

T-Mobile customers can contact customer care by dialling 611 from their device, use two-way messaging on my-tmobile.com, the T-Mobile app, or iMessage through Apple Business Chat. A callback can also be requested via the app and the website.

nunzy

I am loyal to ATT. They were the only ones who gave iPhone a chance. Nobody else had any faith in Apple.

MacPro

That article recently about the 17 year old that hacked the MySql databases in voting machines in a training exercise in a few minutes and was able to change the numbers or even delete them was the scariest thing I've read in a long time.  Time to go back to all paper ballots, pigeons for mail me thinks!

SpamSandwich

MacPro said:

That article recently about the 17 year old that hacked the MySql databases in voting machines in a training exercise in a few minutes and was able to change the numbers or even delete them was the scariest thing I've read in a long time.  Time to go back to all paper ballots, pigeons for mail me thinks!

Have a link?

GeorgeBMac

SpamSandwich said:

MacPro said:

That article recently about the 17 year old that hacked the MySql databases in voting machines in a training exercise in a few minutes and was able to change the numbers or even delete them was the scariest thing I've read in a long time.  Time to go back to all paper ballots, pigeons for mail me thinks!

Have a link?

It was in most main stream media news services. 

From 2017

https://www.cbsnews.com/news/hackers-break-into-voting-machines-defcon-las-vegas/

From 2018

https://www.cnet.com/news/us-officials-hope-hackers-at-defcon-find-more-voting-machine-problems/

And, this year they opened it up to voting systems as well.   But, the voting reporting sites are so vulnerable they gave it to the kids and, an eleven year old girl won by changing Florida's vote count in a matter of minutes.

All in all:  Since our government is doing nothing to stop this or slow this, we should probably count on it happening for real this year.   And, it's not just on election day:  these machines are stored in warehouses and must be programmed by somebody for every election.   They are very vulnerable.   And, in the case of those used in Pennsylvania and others, the machines can neither be verified or recounted.  Whatever comes out of that machine is the one and only final count.

Will hackers determine your state senator this year?   We may never know...

We spend hundreds of billions on planes, boats, bombs and missiles every year.   Yet, any number of entities can decide who's in charge of those weapons and how and if they get used!

GeorgeBMac

Kudos to T-Mobile for reporting it so quickly.   Typically, the hacked firm takes months before they make it public and notify those whose data was stolen.

anton zuykov

MacPro said:

That article recently about the 17 year old that hacked the MySql databases in voting machines in a training exercise in a few minutes and was able to change the numbers or even delete them was the scariest thing I've read in a long time.  Time to go back to all paper ballots, pigeons for mail me thinks!

Why is it the scariest thing? The systems were built by people who don't know what they are doing. The scariest thing is that instead of using PhotoID to verify a person voting and keep a paper proof for a vote, people still have troubles accepting even basic validation of the voter. I would not expect DBs guarded better than the existing system.

skippingrock

Did this affect only current customers?

ronn

anton zuykov said:

MacPro said:

That article recently about the 17 year old that hacked the MySql databases in voting machines in a training exercise in a few minutes and was able to change the numbers or even delete them was the scariest thing I've read in a long time.  Time to go back to all paper ballots, pigeons for mail me thinks!

Why is it the scariest thing? The systems were built by people who don't know what they are doing. The scariest thing is that instead of using PhotoID to verify a person voting and keep a paper proof for a vote, people still have troubles accepting even basic validation of the voter. I would not expect DBs guarded better than the existing system.

In-person voter fraud is miniscule. Voter ID laws are intended to suppress the votes of certain segments of society. There is a higher number of fraud among absentee voting but no efforts to ensure those votes. Probably because certain types of voters are more likely to use that form of voting.

gatorguy

anton zuykov said:

MacPro said:

That article recently about the 17 year old that hacked the MySql databases in voting machines in a training exercise in a few minutes and was able to change the numbers or even delete them was the scariest thing I've read in a long time.  Time to go back to all paper ballots, pigeons for mail me thinks!

Why is it the scariest thing? The systems were built by people who don't know what they are doing. The scariest thing is that instead of using PhotoID to verify a person voting and keep a paper proof for a vote, people still have troubles accepting even basic validation of the voter. 

https://www.nytimes.com/interactive/2016/11/03/us/elections/how-states-moved-toward-stricter-voter-id-laws.html

racerhomie3

ronn said:

anton zuykov said:

MacPro said:

That article recently about the 17 year old that hacked the MySql databases in voting machines in a training exercise in a few minutes and was able to change the numbers or even delete them was the scariest thing I've read in a long time.  Time to go back to all paper ballots, pigeons for mail me thinks!

Why is it the scariest thing? The systems were built by people who don't know what they are doing. The scariest thing is that instead of using PhotoID to verify a person voting and keep a paper proof for a vote, people still have troubles accepting even basic validation of the voter. I would not expect DBs guarded better than the existing system.

In-person voter fraud is miniscule. Voter ID laws are intended to suppress the votes of certain segments of society. There is a higher number of fraud among absentee voting but no efforts to ensure those votes. Probably because certain types of voters are more likely to use that form of voting.

So India must be suppressing 1.2 billion voters? India has Voter ID.

ronn

racerhomie3 said:

ronn said:

anton zuykov said:

MacPro said:

That article recently about the 17 year old that hacked the MySql databases in voting machines in a training exercise in a few minutes and was able to change the numbers or even delete them was the scariest thing I've read in a long time.  Time to go back to all paper ballots, pigeons for mail me thinks!

Why is it the scariest thing? The systems were built by people who don't know what they are doing. The scariest thing is that instead of using PhotoID to verify a person voting and keep a paper proof for a vote, people still have troubles accepting even basic validation of the voter. I would not expect DBs guarded better than the existing system.

In-person voter fraud is miniscule. Voter ID laws are intended to suppress the votes of certain segments of society. There is a higher number of fraud among absentee voting but no efforts to ensure those votes. Probably because certain types of voters are more likely to use that form of voting.

So India must be suppressing 1.2 billion voters? India has Voter ID.

Good for India! We're talking about GOP efforts to suppress voters here in the Good Ol' US of A. These recent efforts mirror the suppression of Black voters from the 50s and 60s -- although those efforts continued in earnest well into the 80s. They mandate voters have IDs and then make it almost impossible or expensive to obtain these IDs. It's a modern-day Poll Tax and blatant racism. It has the residue effect of hurting white voters, but mostly Democractic-leaning constituencies: younger voters (no Student IDs allowed), the elderly (friendly fire/collateral damage as older voters lean GOP) and working class voters that can't afford the price or efforts to obtain documents to in order to get restricted forms of ID.

dws-2

Wow, this conversation took a fast turn!

gatorguy

ronn said:

racerhomie3 said:

ronn said:

anton zuykov said:

MacPro said:

That article recently about the 17 year old that hacked the MySql databases in voting machines in a training exercise in a few minutes and was able to change the numbers or even delete them was the scariest thing I've read in a long time.  Time to go back to all paper ballots, pigeons for mail me thinks!

Why is it the scariest thing? The systems were built by people who don't know what they are doing. The scariest thing is that instead of using PhotoID to verify a person voting and keep a paper proof for a vote, people still have troubles accepting even basic validation of the voter. I would not expect DBs guarded better than the existing system.

In-person voter fraud is miniscule. Voter ID laws are intended to suppress the votes of certain segments of society. There is a higher number of fraud among absentee voting but no efforts to ensure those votes. Probably because certain types of voters are more likely to use that form of voting.

So India must be suppressing 1.2 billion voters? India has Voter ID.

Good for India! We're talking about GOP efforts to suppress voters here in the Good Ol' US of A. These recent efforts mirror the suppression of Black voters from the 50s and 60s -- although those efforts continued in earnest well into the 80s. They mandate voters have IDs and then make it almost impossible or expensive to obtain these IDs. It's a modern-day Poll Tax and blatant racism. It has the residue effect of hurting white voters, but mostly Democractic-leaning constituencies: younger voters (no Student IDs allowed), the elderly (friendly fire/collateral damage as older voters lean GOP) and working class voters that can't afford the price or efforts to obtain documents to in order to get restricted forms of ID.

Driver's license serves fine.  Not a driver? In Florida the cost for an official non-driving photo-ID is $25.00, and valid for 8 years. Requires no more time than going to get your DL.  Homeless? The state may waive that fee if you are. Hardly cost-prohibitive then do you think?  

dkhaley

GeorgeBMac said:

Kudos to T-Mobile for reporting it so quickly.   Typically, the hacked firm takes months before they make it public and notify those whose data was stolen.

And for shutting it down while it was still in progress too.

22july2013

Most systems which store account information store user passwords in encrypted form rather than in plaintext form. If you've ever been a sysadmin you'd understand this. If encrypted passwords were stolen, would that be excluded from the list of stolen items due to its encryption? That seems dicey. Anyone with a weak password (eg, a dictionary word) would find that losing the encrypted version of their password is just as bad as losing the plaintext version. Perhaps companies should be upfront and tell us when *encrypted* copies of our data have been compromised. I don't think that encrypted data should be considered safe because once it's stolen the thieves have lots of time to put the encrypted data under a brute force attack. Including, but not limited to, passwords.

williamh

nunzy said:

I am loyal to ATT. They were the only ones who gave iPhone a chance. Nobody else had any faith in Apple.

I believe it was Cingular that gave iPhone a chance.  AT&T bought Cingular.  I was loyal to Cingular/AT&T for about 15 years, but they weren't loyal to me. Do you travel much with your AT&T phone? The overseas data plans cost a fortune and you get almost nothing. T-Mobile- free texting and data.

ronn

gatorguy said:

ronn said:

racerhomie3 said:

ronn said:

anton zuykov said:

MacPro said:

That article recently about the 17 year old that hacked the MySql databases in voting machines in a training exercise in a few minutes and was able to change the numbers or even delete them was the scariest thing I've read in a long time.  Time to go back to all paper ballots, pigeons for mail me thinks!

Why is it the scariest thing? The systems were built by people who don't know what they are doing. The scariest thing is that instead of using PhotoID to verify a person voting and keep a paper proof for a vote, people still have troubles accepting even basic validation of the voter. I would not expect DBs guarded better than the existing system.

In-person voter fraud is miniscule. Voter ID laws are intended to suppress the votes of certain segments of society. There is a higher number of fraud among absentee voting but no efforts to ensure those votes. Probably because certain types of voters are more likely to use that form of voting.

So India must be suppressing 1.2 billion voters? India has Voter ID.

Good for India! We're talking about GOP efforts to suppress voters here in the Good Ol' US of A. These recent efforts mirror the suppression of Black voters from the 50s and 60s -- although those efforts continued in earnest well into the 80s. They mandate voters have IDs and then make it almost impossible or expensive to obtain these IDs. It's a modern-day Poll Tax and blatant racism. It has the residue effect of hurting white voters, but mostly Democractic-leaning constituencies: younger voters (no Student IDs allowed), the elderly (friendly fire/collateral damage as older voters lean GOP) and working class voters that can't afford the price or efforts to obtain documents to in order to get restricted forms of ID.

Driver's license serves fine.  Not a driver? In Florida the cost for an official non-driving photo-ID is $25.00, and valid for 8 years. Requires no more time than going to get your DL.  Homeless? The state may waive that fee if you are. Hardly cost-prohibitive then do you think?  

Florida allows 12 different forms of ID. But that's because there was a fierce fight to ensure that new ID requirements weren't restrictive. I suspect that the larger percentage of older voters in FL scared away harsher ID laws. Of course, FL suppresses voters in other ways: voter purges that use wholly inaccurate voter rolls, felon disenfranchisement, decreasing early voting days nearly in half and lack of resources in certain polling districts (wanna take a guess what communities those are?).

North Carolina is a perfect example of voter suppression targeting Black, Latino and student groups. They have limited IDs allowed for voting. Essentially a driver's license was mandated and then the state closed the vast majority of DMV offices in Black communities and the ones that remained had extremely limited hours. They disallowed student IDs from non-state colleges/universities, then all student IDs. They decimated early voting. Before they did all of this, they studied how groups voted and went after everything that benefited Black, Latino and student voting. They admitted it. Court have ruled that they went after Black and Democratic voters with precision. Restrictive voter ID laws are blatantly racist. These restrictive ID laws were chiefly motivated to suppress the Black vote in Texas, Wisconsin, North Carolina, Georgia, Indiana, Kansas, Mississippi, Tennessee, Virginia and others.

gatorguy

ronn said:

gatorguy said:

ronn said:

racerhomie3 said:

ronn said:

anton zuykov said:

MacPro said:

That article recently about the 17 year old that hacked the MySql databases in voting machines in a training exercise in a few minutes and was able to change the numbers or even delete them was the scariest thing I've read in a long time.  Time to go back to all paper ballots, pigeons for mail me thinks!

Why is it the scariest thing? The systems were built by people who don't know what they are doing. The scariest thing is that instead of using PhotoID to verify a person voting and keep a paper proof for a vote, people still have troubles accepting even basic validation of the voter. I would not expect DBs guarded better than the existing system.

In-person voter fraud is miniscule. Voter ID laws are intended to suppress the votes of certain segments of society. There is a higher number of fraud among absentee voting but no efforts to ensure those votes. Probably because certain types of voters are more likely to use that form of voting.

So India must be suppressing 1.2 billion voters? India has Voter ID.

Good for India! We're talking about GOP efforts to suppress voters here in the Good Ol' US of A. These recent efforts mirror the suppression of Black voters from the 50s and 60s -- although those efforts continued in earnest well into the 80s. They mandate voters have IDs and then make it almost impossible or expensive to obtain these IDs. It's a modern-day Poll Tax and blatant racism. It has the residue effect of hurting white voters, but mostly Democractic-leaning constituencies: younger voters (no Student IDs allowed), the elderly (friendly fire/collateral damage as older voters lean GOP) and working class voters that can't afford the price or efforts to obtain documents to in order to get restricted forms of ID.

Driver's license serves fine.  Not a driver? In Florida the cost for an official non-driving photo-ID is $25.00, and valid for 8 years. Requires no more time than going to get your DL.  Homeless? The state may waive that fee if you are. Hardly cost-prohibitive then do you think?  

Florida allows 12 different forms of ID. But that's because there was a fierce fight to ensure that new ID requirements weren't restrictive. I suspect that the larger percentage of older voters in FL scared away harsher ID laws. Of course, FL suppresses voters in other ways: voter purges that use wholly inaccurate voter rolls, felon disenfranchisement, decreasing early voting days nearly in half and lack of resources in certain polling districts (wanna take a guess what communities those are?).

North Carolina is a perfect example of voter suppression targeting Black, Latino and student groups. They have limited IDs allowed for voting. Essentially a driver's license was mandated and then the state closed the vast majority of DMV offices in Black communities and the ones that remained had extremely limited hours. They disallowed student IDs from non-state colleges/universities, then all student IDs. They decimated early voting. Before they did all of this, they studied how groups voted and went after everything that benefited Black, Latino and student voting. They admitted it. Court have ruled that they went after Black and Democratic voters with precision. Restrictive voter ID laws are blatantly racist. These restrictive ID laws were chiefly motivated to suppress the Black vote in Texas, Wisconsin, North Carolina, Georgia, Indiana, Kansas, Mississippi, Tennessee, Virginia and others.

How do you suggest reliable citizenship and eligibility to vote be established? Related to that is the rationale for Real-ID valid in your opinion?

EDIT: In hindsight nevermind. The thread is veering off-topic.

ronn

I'm getting sick and tired of companies allowing data to be compromised, but there isn't much we can do about it as consumers. I don't think T-Mobile should be patted on the back for revealing the breach so quickly. Were they not currently involved in a merger with Sprint, they'd probably wait on releasing this info until the last possible moment -- if at all.

ronn

gatorguy said:

ronn said:

gatorguy said:

ronn said:

racerhomie3 said:

ronn said:

anton zuykov said:

MacPro said:

That article recently about the 17 year old that hacked the MySql databases in voting machines in a training exercise in a few minutes and was able to change the numbers or even delete them was the scariest thing I've read in a long time.  Time to go back to all paper ballots, pigeons for mail me thinks!

Why is it the scariest thing? The systems were built by people who don't know what they are doing. The scariest thing is that instead of using PhotoID to verify a person voting and keep a paper proof for a vote, people still have troubles accepting even basic validation of the voter. I would not expect DBs guarded better than the existing system.

In-person voter fraud is miniscule. Voter ID laws are intended to suppress the votes of certain segments of society. There is a higher number of fraud among absentee voting but no efforts to ensure those votes. Probably because certain types of voters are more likely to use that form of voting.

So India must be suppressing 1.2 billion voters? India has Voter ID.

Good for India! We're talking about GOP efforts to suppress voters here in the Good Ol' US of A. These recent efforts mirror the suppression of Black voters from the 50s and 60s -- although those efforts continued in earnest well into the 80s. They mandate voters have IDs and then make it almost impossible or expensive to obtain these IDs. It's a modern-day Poll Tax and blatant racism. It has the residue effect of hurting white voters, but mostly Democractic-leaning constituencies: younger voters (no Student IDs allowed), the elderly (friendly fire/collateral damage as older voters lean GOP) and working class voters that can't afford the price or efforts to obtain documents to in order to get restricted forms of ID.

Driver's license serves fine.  Not a driver? In Florida the cost for an official non-driving photo-ID is $25.00, and valid for 8 years. Requires no more time than going to get your DL.  Homeless? The state may waive that fee if you are. Hardly cost-prohibitive then do you think?  

Florida allows 12 different forms of ID. But that's because there was a fierce fight to ensure that new ID requirements weren't restrictive. I suspect that the larger percentage of older voters in FL scared away harsher ID laws. Of course, FL suppresses voters in other ways: voter purges that use wholly inaccurate voter rolls, felon disenfranchisement, decreasing early voting days nearly in half and lack of resources in certain polling districts (wanna take a guess what communities those are?).

North Carolina is a perfect example of voter suppression targeting Black, Latino and student groups. They have limited IDs allowed for voting. Essentially a driver's license was mandated and then the state closed the vast majority of DMV offices in Black communities and the ones that remained had extremely limited hours. They disallowed student IDs from non-state colleges/universities, then all student IDs. They decimated early voting. Before they did all of this, they studied how groups voted and went after everything that benefited Black, Latino and student voting. They admitted it. Court have ruled that they went after Black and Democratic voters with precision. Restrictive voter ID laws are blatantly racist. These restrictive ID laws were chiefly motivated to suppress the Black vote in Texas, Wisconsin, North Carolina, Georgia, Indiana, Kansas, Mississippi, Tennessee, Virginia and others.

How do you suggest reliable citizenship and eligibility to vote be established? Related to that is the rationale for Real-ID valid in your opinion?

You brought up Florida. The reliable and fair solution there was fought tooth and nail, allowing non-restrictive voter IDs. The non-drivers ID fee is reasonable only because it was fought for tooth and nail. It's valid for a decent amount of time only because that was fought for tooth and nail. And indigent individuals may (why not guaranteed?) get a free ID because it was fought for tooth and nail. And remember, there are 11 other forms of ID allowed. Other states have super restrictive ID laws because of racial and political motivations. But remember, Florida went out of its way to suppress certain constituencies after failing to implement stricter ID laws though.