T-Mobile Database Breach Exposes 2M Customers' Data

https://www.databreachtoday.com/t-mobile-database-breach-exposes-2-million-customers-data-a-11420

by Nazzareno • 8 years ago

113 77 8 years ago

ourmandave• 8 years ago

Only 2 million?

Seems low. I wonder if they'll adjust it upwards like every other data breach that happens every week since I can remember?

Sadly, I don't even care since I was never a T-Mobile customer and they already have my entire life like f*cking Keyser Soze 50x times over.

MrEfficiency2• 8 years ago

After being a Tmobile customer for 6 years(and leaving this year), I do not trust a word they say.

Here is a list of unethical things they've done-

Claim UNLIMITED when restricting people at 10gb hotspot and 50gb data. Their depriortization is unusable, but they claim otherwise.
They sent their social media marketing team to astroturf in an /r/frugal thread critical of tmobile.
Their customer service person canceled a plan and added a plan when moving around numbers. I dont know if this was intended or an accident, but after 2 months of paying extra, I asked for a refund, the store wouldnt do it. I had to call. This was a 2 hour process.

So 2M customer data? Says tmobile.

So no passwords stolen? Says tmobile.

I remember when they were 'the good guys'.

brink• 8 years ago

Who did you move to?

toomuchtodo5• 8 years ago

I've had T-Mobile for ~18 years (since they acquired VoiceStream in Chicago). Yes, the customer service folks aren't on point (and I've had to escalate issues to their executive customer support team). Yes, their data breach caused my data to be exposed. Am I moving? Not at all. Where else am I going to go that's better? Sprint? Terrible network and most likely about to be absorbed by T-Mobile. AT&T and Verizon? Both have had similar SIM replacement breaches by customer service (either coordinated attacks or ignorant reps ignoring procedure), and are wildly more expensive for the same service.

Your mistake is the illusion of choice. There are no good mobile carriers, only the least worst.

theossuary• 8 years ago

I've had their customer support and in-store employees straight up lie to me about terms and conditions to get me to buy things. I'll never use T-Mobile again after crap like that.

post_break2• 8 years ago

Name one carrier that has unlimited with unlimited data, no caps, no slow downs. Go ahead I'll wait.

instaheat• 8 years ago

This. Yes, please tell us. I was considering switching to T-Mobile from AT&T. T-Mobile's price point is much better, obviously.

usermac2• 8 years ago

T-Mobile ONE for US vets. I signed up three months ago and it is truly unlimited.

everybodyknows• 8 years ago

Another for the list: a single stray tap on some ad got me (silently) enrolled in some useless service, charged directly to my T-mobile bill.

Workaround: Pay monthly, resist their pressure to sign up for auto-pay. Shift bill payment chore day to third week of each month, to deal with T-mo's 17-day window between billing and overdue dates.

All that said, from what I've seen, the competing providers are worse still.

m52go• 8 years ago

Purism's carrier-less phone cannot come fast enough.

shrimp_emoji• 8 years ago

Sounds like a regular computer but small and with an LTE modem. That should be the future, but, barring making cell networks a free, national utility, I don't understand how there still aren't carriers (ISPs) that map customers to a device (unless they charge a flat, global fee for general access) and possess at least some of their data.

(In general, though, SMS 2FA is a bad idea; device, not SIM-based, things like Google Authenticator are much better and render SIM hijacks toothless as far as 2FA is concerned. You're still hosed with respect to your payment method, address, carrier credentials, etc. of course.)

seibelj• 8 years ago

I have T-Mobile. 6 weeks ago my phone could no longer access the cell network. The support agent told me that someone went into a store, claimed to be me, and was able to change the SIM card. The history showed the employee in the store verified me by my driver's license. We changed the SIM back and supposedly locked the account.

I use Google Auth OTP for all the accounts that I can, and as far as I can tell nothing was breached or stolen, but I wouldn't rely on your cell phone or number for anything whatsoever, it's way too easy to socially engineer, or have some easily corruptible retail employee steal from you.

kuwze• 8 years ago

Reminds me of this:

https://www.ccn.com/bitcoin-investor-sues-att-for-224-millio...

https://cointelegraph.com/news/california-police-arrest-teen...

hippich• 8 years ago

Similar thing happened to me about a year ago. The creepiest part was - it happened while I was in the international flight and my gmail WAS on sms "two factory" authentication... Since then everywhere i can I used OTP, but some sites fallback to use your phone number if you can't provide OTP password... So I have to enter some completely invalid phone number there to make it impossible.

acomar• 8 years ago

There are a few sites that won't accept this and won't even accept a Google Voice/VOIP number because they do some kind of check. Very frustrating.

gowld• 8 years ago

What's the point of having a lock (OTP) if the lock is removed upon an attacker's request?

inetknght• 8 years ago

SMS is not two factor authentication, no matter what ISPs or websites tell you.

swarnie_• 8 years ago

I remember this being a common tactic to break in to youtube/twitter accounts with 2FA enabled a few years back, really shocked its still going on.

hb3b• 8 years ago

That's bad but at least they checked. Apple recently swapped out a phone for me at the store. The genius called Sprint and they activated the new phone on my Dad's line without asking me for ID or my account code.

Imagine if this were to happen to a journalist or politician. The stakes are quite high.

s73v3r_4• 8 years ago

Honestly, I think one of the best things to happen for the rest of us is for a prominent Senator to have this happen to them. Then hopefully we'd get some legislation holding these companies responsible when they do that.

rm999• 8 years ago

T-mobile is horrible with security. They have this service called Digits, which lets users access their phone number from other devices. The problem is, this subverts the security model a lot of the American internet ecosystem is built on, i.e. your phone number will be secure online. Someone got into my t-mobile account and enabled Digits, then had free-reign on my gmail, texts, paypal, etc (I don't use the strongest passwords, but always keep 2-factor authentication on important services like these). Every time I got hacked I'd spend a couple hours of trying to figure out how, and the T-mobile agents would always claim no one accessed my number. Finally, the third time, I escalated up the security chain within T-mobile and they figured out the issue.

https://www.t-mobile.com/offers/t-mobile-digits

MrEfficiency2• 8 years ago

Not to mention digits SUCKS.

My wife used this for her business since it was free at the time. It cost her literally thousands of dollars of missed/unconnected calls and dozens of hours of customer service.

r00fus2• 8 years ago

Is there any way to turn off Digits?

bogomipz3• 8 years ago

Do they actually support third party 2FA for their customers?

akshayB2• 8 years ago

I think its about time US passes laws that any company that suffers a data breach is mandated to give a identity theft protection for 1 year to people who's information was compromised.

chadlavi• 8 years ago

if that were the case, by this point most of us would have lifetime protection

akshayB2• 8 years ago

That should be good for everyone because CEO's and company executive walkway and no one is held accountable.

Broken_Hippo2• 8 years ago

I doubt that it would stack, though. It'd simply mean that the data protection companies got lots of money since more than one company would pay for protection for a single customer. If data breaches somehow stopped today, we'd all be without "protection" within a year.

Someone12342• 8 years ago

Identity theft protection doesn't do anything, it isn't even "protection" just notification after the fact and some agent will hold your hand.

Instead how about companies have complete financial liability? That way they'll need insurance, and their premiums will skyrocket if they get breached.

ulkesh• 8 years ago

Nice idea, but in the end the consumer will be the one who pays for it.

kodablah2• 8 years ago

I'll take laws just requiring transparency. I want to know exactly what happened, exactly what was taken, how much, exactly how the passwords were hashed, etc.

T-Mobile declined to comment. "We don't discuss publicly how we encrypt passwords,"

That is unacceptable, data breach or not.

glennpratt• 8 years ago

While I agree with the sentiment, everyone should have basic identify theft protection for free. SSN should not be so insecure or should not be used and the stuff the credit bureaus offer seems like a protection racket.

mnm1• 8 years ago

Make it life. The reason identity theft protection exists is because we have inadequate laws to sue these companies in the first place. If someone's identity gets stolen, the breached company should be fully responsible without the user having to file a lawsuit and pay a ton of money / spend a lot of time trying to fix things. Just to be clear, the breached company is typically the credit issuer or any party that allows unauthorized access to the wrong person. It's preposterous that the user has to pay for a mistake by the bank who gave a loan or other type of credit to an impostor. Make these institutions pay and fine then a percentage of their annual revenue up to a hundred percent. You'll see how quickly security practices change.

s73v3r_4• 8 years ago

So if I'm in multiple databases, as we all are, and multiple ones get breached, which one is responsible when that happens?

scient• 8 years ago

There is no such thing as identity theft protection. Its all snake oil.

koolba2• 8 years ago

Screw identity theft protection. It's at best pointless and at worst a scam to get you to pay to continue the "protection" after the initial period expires.

They should instead have a minimum fine per-user that gets paid in cash directly to the impacted individuals. Paying $10 x 1M accounts would make businesses wake up to this problem much faster. Maybe even have the fine be tiered based on the level of data that was compromised:

    Email - $10
    Hashed Password - $25
    Plaintext Password - $100
    SSN - $500

weej4• 8 years ago

Agreed. If one wants to change the business's behavior there has to be financial penalty to incentive them to get their act together. Currently, there's zero regulatory compliance required with little to no impact to the company other than momentary bad PR that is not withstanding.

Broken_Hippo2• 8 years ago

I'm not sure that would do anything other than spur the companies to have an identity theft protection department.

I'd rather them give basic compensation to anyone with breached data (even if it is $10) in addition to covering the costs of anyone who had problems after the breach. The first year, I'd think it would be best if the consumer didn't have to prove it was their fault as that could be too much of a burden for folks.

I'd give an exception for companies that went over and above on their own security and still got breached. After all, security doesn't make one completely safe (much like places can still get robbed), simply less likely.

s73v3r_4• 8 years ago

1 year? Screw that. 10 years, minimum.

kodablah2• 8 years ago

Ceraolo, who says he was not involved in the breach, says he was able to confirm that the hacker accessed T-Mobile via a vulnerable API.

I want some details here. Just the other day we had a blog post lauding fairly open API approaches for client UIs (in GraphQL, but I see similar arguments elsewhere). Lock your shit down, don't give the frontend more than it needs, and if you're in a company with some type of ridiculous team separation where the backend has to treat the frontend as a customer that doesn't work for the company it's just a matter of time.

Not saying this was a frontend API, just saying it's a frequent vector due to the lax auth requirements and "internal" query-like approach they often take.

RobertRoberts• 8 years ago

Anyone have any good suggestions for what a customer should do when their service provider has been breached?

darkstar999• 8 years ago

Change your password and make sure you don't share the same password between different sites/services.

weej4• 8 years ago

Additionally to changing password, if you don't already start leveraging a password manager: lastpass, 1password, etc.

mrep• 8 years ago

T-Mobile's assertion that no password information was stolen - and later clarification that encrypted passwords were exposed

Call me skeptical considering they said 4 months ago that they store part of their passwords in plain text: https://motherboard.vice.com/en_us/article/7xdeby/t-mobile-s...

Crosseye_Jack• 8 years ago

That was T-Mobile Austria and at the time T-Mobile USA (and iirc a couple other T-Mobile subsidiaries) said they used a different customer account system than T-Mobile Austria and handle account passwords differently.

(T-Mobile Austria has since figured out that storing this is a bad idea and promised to change how they do it. Dunno what they have done as I'm not a customer of them nor live in Austria, I just remember the the shitstorm on twitter about it.)

heywot3• 8 years ago

My favorite part about all of this is that, as a T-Mobile customer, this is how I find out about the leak. There's not even an alert when I log into my account. Why can't companies be more responsible about these situations?

toomuchtodo5• 8 years ago

If your data was breached, you would've received an SMS message or email.

heywot3• 8 years ago

I still think making customers aware would go a long way. And we only have to go back to the Equifax breach to learn that companies are hardly forthcoming about who is and isn't compromised.

s73v3r_4• 8 years ago

How do I know that?

jsgo• 8 years ago

I found out about this breach Friday via The Verge. At that point in time, I didn't receive an email/text. So for a while, I figure I'm not part of the subset of users. Then, at 9:11pm that day, I received the text message.

kevin_thibedeau2• 8 years ago

But a T-Mobile spokeswoman later told news site Motherboard that "encrypted" passwords were in the batch of data.

T-mobile stores plaintext passwords. They recently invalidated a password I had been using with them for some time because they changed their rules and disallowed special characters (tons of stupid there). They wouldn't have known to do that if the passwords were properly hashed.

weej4• 8 years ago

I had same reaction over weekend when I reset my password. I tried to use 20 char length with some special characters and their "validation" blocks it. Poor password management irritates me to no end.

tyleraldrich2• 8 years ago

This isn't necessarily true (and is very dependent on what your password was) - they could have iterated through lists of common passwords w/ special characters, hashed them, and compared them to their DB, forcing a pw reset for everyone that had a match.

edit - just want to state that if they disallow special characters it really is a terrible policy, my point is just that resetting your password isn't proof they are stored in plaintext

kevin_thibedeau2• 8 years ago

Not salting passwords in 2018 is also idiotic lunacy.

chaoticmass• 8 years ago

I doubt they did this, but I was just thinking about this problem--

Maybe they could have analyzed the plaintext password and stored information about the types of characters it contained and number of characters. Then they salt+hash the plaintext password and store the resulting hash. Now they know a little about the characters and length of the password without knowing the password itself.

Again, I doubt they did this.

negativegate• 8 years ago

If they invalidated the password when you logged in then this is possible even if the password is hashed because you just gave it to them.

ppseafield• 8 years ago

Did you get an email saying this, or did this happen when you logged in? At login they could examine the password you sent, check if it matched their hash, and then prompt you to change it.

jschwartzi• 8 years ago

They allowed me to put a slash in my password. Did this happen within the last two weeks?

wegs• 8 years ago

A while back, I ran into a security hole in T-Mobile. Confidential customer data was quite literally available on the Internet via a Google search. This was due to a half-dozen missing very basic security precautions (forms using GET instead of POST, no CSRF, etc., etc., etc.).

I emailed the CEO. It got moved to a team who assured him there were no problems. The pages got taken down, but the underlying issues were, as far as I know, ignored (the communication to the CEO was essentially that there were no issues, and he believed his team over me).

I still trust T-Mobile more than Spring/AT&T/Verizon as a company, but data security is non-existent.

I'm not quite sure what to do with that.

bogomipz3• 8 years ago

And it was only 3 years ago that T-mobile that affected 15 million, which they largely blamed on Experian at the time.

"On Sept. 15, 2015 Experian discovered an unauthorized party accessed T-Mobile data housed in an Experian server. Records containing a name, address, Social Security number, date of birth, identification number (typically a driver’s license, military ID, or passport number) and additional information used in T-Mobile's own credit assessment were accessed."

T-Mobiles response to that incident was to offer customers 2 years of free credit monitoring service from Experian. That free service would have ended a year ago, just in time for the T-Mobile's next breach.

Clearly nothing has changed at T-Mobile.

https://www.t-mobile.com/customers/experian-data-breach-faq

bogomipz3• 8 years ago

In looking at T-mobile's home page there is no mention of the breach. Wouldn't the responsible thing for them to do is post it somewhere high profile that their customer's might see it?

Instead the notice is buried here which doesn't even appear to be a linked to on their home page.

https://www.t-mobile.com/customers/6305378821

T-Mobile Database Breach Exposes 2M Customers' Data

Related Stories