T-Mobile today officially confirmed that it was the victim of a data breach that may impact more than 100 million T-Mobile customers.
As we reported earlier today, T-Mobile suffered a breach of its servers that apparently resulted in the exposure of data connected to more than 100 million T-Mobile customers. The data is being sold on a hacker forum.
On Sunday, the wireless carrier said that it was investigating a post on a hacker forum by a poster that claimed to be selling data related to T-Mobile customers. The poster claims to have acquired data on over 100 million people, taken from Magenta Network servers.
The data stems from “T-Mobile USA. Full customer info,” the forum poster told Motherboard. Multiple servers were allegedly compromised to get it.
The data appears to include names, phone numbers, physical addresses, IMEI numbers, driver license information, and social security numbers. Samples obtained in reports appear to be genuine.
The T-Mobile statement says that while there has indeed been some unauthorized access to some customer data, it hasn’t yet determined if personal customer data has been accessed:
We have been working around the clock to investigate claims being made that T-Mobile data may have been illegally accessed. We take the protection of our customers very seriously and we are conducting an extensive analysis alongside digital forensic experts to understand the validity of these claims, and we are coordinating with law enforcement.
We have determined that unauthorized access to some T-Mobile data occurred, however we have not yet determined that there is any personal customer data involved. We are confident that the entry point used to gain access has been closed, and we are continuing our deep technical review of the situation across our systems to identify the nature of any data that was illegally accessed. This investigation will take some time but we are working with the highest degree of urgency. Until we have completed this assessment we cannot confirm the reported number of records affected or the validity of statements made by others.
We understand that customers will have questions and concerns, and resolving those is critically important to us. Once we have a more complete and verified understanding of what occurred, we will proactively communicate with our customers and other stakeholders.
T-Mobile says the access hole used to gain access to its data has been plugged and it is now conducting a “deep technical review” of the situation. The wireless carrier says it will proactively communicate with customers when more information is available.