T-Mobile says 5.3M more customers affected by breach, IMEI data stolen

AppleInsiderAppleInsider
Posted:
in General Discussion
T-Mobile has confirmed that a massive data breach affecting both current and former customers is now worse than it originally reported.

Credit: T-Mobile
Credit: T-Mobile


The carrier on Friday confirmed that leaked information for 7.8 million current postpaid customers also included phone numbers and International Mobile Equipment Identity (IMEI) numbers, which are unique identifiers assigned to every mobile device. T-Mobile has been investigating the data breach and sharing more details as they come to light.

Notably, IMEI data could potentially be used to track the location of mobile devices or be used in SIM swapping attacks that could aid bad actors in bypassing multi-factor authentication for accounts.

An unspecified number of files contained "phone numbers, IMEI, and IMSI numbers." Although T-Mobile claims those files did not contain any personally identifiable information, the data can be easily used to tie a person's identity to their phone number.

T-Mobile also confirmed that the data breach has affected an additional 5.3 million current customers and 667,000 former subscribers. However, those customers did not have their driver's license or ID or their Social Security numbers leaked as part of the breach.

While former Boost Mobile or Sprint prepaid customers were not affected by the breach, the carrier has said that 52,000 names tied to Metro by T-Mobile accounts were stolen.

Earlier in August, reports indicated that bad actors were selling data on 100 million T-Mobile customers after a server attack. T-Mobile later confirmed that at least 47.9 million people were affected by the server breach.

On Friday, the personal data of more than 70 million AT&T customers was also found for sale on an underground hacking forum.

Read on AppleInsider

Comments

  • Reply 1 of 9
    KTRKTR Posts: 279member
    I wonder how many of that data were from Apple devices ?
  • Reply 2 of 9
    pulseimagespulseimages Posts: 597member
    Everyone freeze your credit! 
    watto_cobra
  • Reply 3 of 9
    baconstangbaconstang Posts: 1,105member
    No wonder T-Mo is offering great deals right now.
    caladanianwatto_cobra
  • Reply 4 of 9
    mac_dogmac_dog Posts: 1,069member
    Got an email from Spider oak yesterday. Changed my password, removed my credit card as well. 
    watto_cobra
  • Reply 5 of 9
    fastasleepfastasleep Posts: 6,417member
    KTR said:
    I wonder how many of that data were from Apple devices ?
    Why would that be of interest?
    GeorgeBMacwatto_cobra
  • Reply 6 of 9
    GeorgeBMacGeorgeBMac Posts: 11,421member
    I was apparently one of those whose data was hacked.  I got this message from T-Mobile last evening:

    "T-Mobile has determined that unauthorized access to some of your information has occurred, like name, address, phone number, and DOB.  Importantly we have NO information that indicates your SSN, personal financial or payment information, credit /debit card information, account numbers or account passwords were accessed. .... [the rest is "Don't worry, be happy - we love you and care about you" nonsense]".

    Critically, they made no mention of IMEI numbers.

    All of this supports the question here in this article about how this might impact 2 factor security.
    While I always welcomed vendors who use it I think Chase has the best method:  When logging in on a browser, they don't let you in until you log on to their mobile app -- it's one step beyond 2 factor authentication.
    caladanian
  • Reply 7 of 9
    rbnetengrrbnetengr Posts: 72member
    Two-factor, or multi-factor authentication that relies on SMS messages for the second factor has already been deemed unsafe, and companies should move away from it. Having a hardware or software device that generates time limited tokens is a better and safer approach. Or, Microsoft’s fairly recent use of passwordless authentication seems to be relatively safe. 
    watto_cobra
  • Reply 8 of 9
    GeorgeBMacGeorgeBMac Posts: 11,421member
    rbnetengr said:
    Two-factor, or multi-factor authentication that relies on SMS messages for the second factor has already been deemed unsafe, and companies should move away from it. Having a hardware or software device that generates time limited tokens is a better and safer approach. Or, Microsoft’s fairly recent use of passwordless authentication seems to be relatively safe. 

    That's the false "black and white" argument for security:   That it's either effective or it's not.

    Reality is that NO security system is 100% effective 100% of the time. 
    As a security auditor once told me: "If they want in, they'll get in.  The trick is to make it hard enough where they break in somewhere else".

    It's a matter of how much security is needed and how much aggravation is one willing to put up with?
  • Reply 9 of 9
    gatorguygatorguy Posts: 24,212member
    GeorgeBMac said:
    rbnetengr said:
    Two-factor, or multi-factor authentication that relies on SMS messages for the second factor has already been deemed unsafe, and companies should move away from it. Having a hardware or software device that generates time limited tokens is a better and safer approach. Or, Microsoft’s fairly recent use of passwordless authentication seems to be relatively safe. 

    That's the false "black and white" argument for security:   That it's either effective or it's not.

    Reality is that NO security system is 100% effective 100% of the time. 
    As a security auditor once told me: "If they want in, they'll get in.  The trick is to make it hard enough where they break in somewhere else".

    It's a matter of how much security is needed and how much aggravation is one willing to put up with?
    A YubiKey makes it far FAR harder to do so. That's what I use for Google services or anywhere else that can take it, and it's not really inconvenient. I keep the key with me. Some other companies don't offer that as an option and insist on sending codes via SMS.
    GeorgeBMac
Sign In or Register to comment.