T-Mobile discloses breach affecting about 37 million accounts

T-Mobile said on 19 January that unauthorized access through an application programming interface exposed data from about 37 million prepaid and postpaid customer accounts.

Photo: Mike Mozart, “T-Mobile”. CC BY 2.0. 2015 photograph; responsive crops.

In its SEC filing, the carrier said it detected the activity on 5 January and stopped it within a day. It believes access began around 25 November 2022.

The filing says accessible data included names, addresses, emails, phone numbers, birth dates, account numbers and plan details. Many accounts lacked the complete dataset.

T-Mobile said passwords, PINs, payment cards, government identifiers and other financial account information were not exposed. Its investigation remains ongoing; the company said the activity appeared contained and it had begun notifying affected customers.