BOSTON– US wireless service provider T-Mobile said Thursday that an unidentified malicious intruder broke into its network in late November and stole data from 37 million customers, including addresses, phone numbers and dates of birth.
T-Mobile said in a filing with the US Securities and Exchange Commission that the breach was discovered on January 5. The data exposed for theft — based on the investigation to date — did not include passwords or PINs, bank account or credit card information, social security numbers, or other government-issued identification.
WATCH NOW ABC7 Los Angeles 24×7 Streaming Channel
“Our investigation is ongoing, but malicious activity appears to be fully contained at this time,” T-Mobile said, with no evidence the intruder was able to penetrate the company’s network. Data was first accessed on or about November 25.
T-Mobile said it notified law enforcement and federal agencies, which it did not name. It didn’t immediately respond to an email asking for comment.
The company has been hacked multiple times in recent years. In its filing, T-Mobile said it does not expect the latest breach to have a material impact on its operations. However, Neil Mack, a senior analyst with Moody’s Investors Service, said in a statement that the breach raises questions about management’s cyber governance and could unsettle customers and draw scrutiny from the Federal Communications Commission and other regulators.
“While these cybersecurity breaches are not systemic in nature, their frequency at T-Mobile is an alarming outlier compared to telecom peers,” Mack said.
In July, T-Mobile agreed to pay $350 million to customers who filed a class action lawsuit after the company announced in August 2021 that personal information, including social security numbers and driver’s license information, had been stolen. Almost 80 million US citizens were affected.
It also said at the time that it would spend $150 million by 2023 to strengthen its data security and other technologies.
Prior to the August 2021 intrusion, the company disclosed breaches in January 2021, November 2019, and August 2018 that involved accessing customer information.
Headquartered in Bellevue, Washington, T-Mobile became one of the country’s largest wireless carriers in 2020 after buying competitor Sprint. It said it had more than 102 million customers after the merger.