T-Mobile says at least 47M current and former customers affected by data breach

T-Mobile has confirmed that millions of current and former customers had their information stolen in a data breach, following reports of a hack over the weekend.

In a statement, T-Mobile, which has more than 100 million customers, said its preliminary analysis shows 7.8 million current postpaid T-Mobile customers had information taken in the data breach. The carrier said that some personal data on current and former postpaid was also taken, including customer names, dates of birth, Social Security numbers, and driver’s license information for a “subset” of current and former postpay customers and prospective T-Mobile customers.

The company also said that 40 million records of former and prospective customers was taken, but that “no phone numbers, account numbers, PINs, passwords, or financial information were compromised.”

But the company warned that approximately 850,000 active T-Mobile customer names, phone numbers, and account PINs were in fact compromised, and that customer names, phone numbers and account PINs were exposed. T-Mobile said it’s reset those customer PINs. T-Mobile said it was “recommending all postpaid customers” to proactively change their account PIN, which protects their accounts from SIM-swapping attacks.

Vice reported this weekend that T-Mobile was investigating a possible hack after a seller on a known criminal forum claimed to be in possession of millions of records. The seller told Vice that they had 100 million records on T-Mobile customers, which included customer account names, phone numbers, and the IMEI numbers of phones on the account.

T-Mobile warned that there could be more fallout to come, noting that it confirmed there was “some additional information from inactive prepaid accounts accessed through prepaid billing files,” but did not say what, only that it was not financial information.

This is the fifth time that T-Mobile was hacked in recent years, following incidents as recently as January and other incidents dating back to 2018.