T-Mobile disclosed the theft of 37 million user accounts in a corporate report on Thursday. The telecom company claimed that the theft of customer information began on November 25 and that the “bad actor” had access to “name, billing address, email, phone number, date of birth, T-Mobile account number and information such as the number of lines on the account and plan features.”
According to the SEC filing, T-Mobile discovered the breach on January 5, 2019, almost a month after it had occurred, and repaired the vulnerability that was being used by the hacker the following day.
Read More: The Future of Facial Recognition Technology 2022
According to T-Mobile, the hackers did not compromise any business systems but instead misused an API.
While the company’s investigation is ongoing, it appears that the malicious activity has been controlled and there is no evidence that the bad actor was able to infiltrate or damage the company’s systems or network.
Since 2018, this is T-eighth Mobile’s breach. In the most recent incident, which occurred in 2022, a hacking group going by the name of Lapsus$ gained access to the company’s internal tools, allowing them to perform SIM swaps.
SIM swaps are a type of hack in which the hacker temporarily assumes control of a victim’s phone number in order to gain access to that person’s other accounts, such as email or cryptocurrency wallets.