The alleged hacker behind T-Mobile’s latest cyberattack has spoken out about the August hack. The breach includes names, driver’s license numbers, Social Security numbers and device identification (IMEI and IMSI) numbers for subscribers, former customers and even prospective customers who may have been interested in T-Mobile service. Metro by T-Mobile may be impacted, too.
John Brinns, the 21-year-old who claims responsibility for the hack, detailed the breach that affected over 54 million people, in an interview with The Wall Street Journal. Brinns shared that the key to the cyberattack was one of T-Mobile’s unprotected routers and weak spots in the company’s internet addresses that apparently gave him access to over 100 servers. He was able to access the data on Aug. 4; T-Mobile reported the attack on Aug. 16.
Since the attack, the wireless carrier is now offering free identity theft protection, advanced spam-blocking and access to its Account Takeover Protection service to protect postpaid customers from their phone numbers being stolen.
The company has also reset PINs for all prepaid customers after the exposure of 850,000 accounts, T-Mobile’s CEO, Mike Sievert, wrote in a blog post that there’s “no indication” that financial data like credit card or other payment information was compromised and said that “there is no ongoing risk to customer data from this breach.” Brinns, however, did not share with the Journal whether he sold the data or if he was paid to carry out the breach — which could be a bigger problem for those affected.
T-Mobile released a statement confirming that the names, dates of birth, social security numbers, driver’s licenses, phone numbers, as well as IMEI and IMSI information for about 7.8 million customers had been stolen in the breach.
Another 40 million former or prospective customers had their names, dates of birth, social security numbers and driver’s licenses leaked.
More than 5 million “current postpaid customer accounts” also had information like names, addresses, date of births, phone numbers, IMEIs and IMSIs illegally accessed.
T-Mobile said another 667,000 accounts of former T- Mobile customers had their information stolen alongside a group of 850,000 active T-Mobile prepaid customers, whose names, phone numbers and account PINs were exposed. The names of 52,000 people with Metro by T-Mobile accounts may also have been accessed, according to T-Mobile.
Leave a Reply