T-Mobile earlier this week shared details on a data breach where hackers gained access to the personal information of close to 50 million current, former, and prospective customers.
At the time, T-Mobile said that data from 7.8 million current customers had been compromised, as well as information from 40 million former or potential customers. In an updated statement provided today, T-Mobile says that it has confirmed that data from another 5.3 million postpaid customers was accessed.
Information accessed from these customers included names, addresses, birth dates, phone numbers, IMEIs, and IMSIs. The prior 7.8 million customers also saw their SSN and driver's license information stolen.
T-Mobile says that on top of the previously announced 40 million former or prospective customers that were impacted, another 667,000 accounts of former customers were breached. Hackers were able to obtain names, phone numbers, addresses, and birth dates from these customers. Other former and prospective customers had their SSN and driver's license information leaked.
Hackers were also able to access data files that included phone numbers, IMEI numbers, and IMSI numbers, but that data included no personally identifiable information. T-Mobile says that it does not believe that the data in the stolen files included customer financial information, credit card information, debit, or other payment information.
There were 850,000 T-Mobile postpaid customers impacted with phone numbers and PINs exposed, and T-Mobile has reset the PINs on all of these accounts. T-Mobile now says that up to 52,000 names related to current Metro by T-Mobile accounts may also have been included, but none of the T-Mobile files stolen related to former Sprint prepaid or Boost customers.
The attack was first identified when hackers posted on a forum offering to sell data from 100 million T-Mobile customers. The data for sale included social security numbers, phone numbers, names, physical addresses, IMEI numbers, and driver's license data.
T-Mobile says that it has contacted millions of customers and is offering those impacted two years of identity protection services with McAfee's ID Theft Protection Service. The company also recommends that eligible T-Mobile customers sign up for free scam-blocking protection.
To prevent future attacks, T-Mobile says it has "worked diligently to enhance security across our platforms" and is working with experts to understand both immediate and longer-term next steps.
