Attackers accessed T-Mobile’s network in 2021 after exploiting an unprotected GPRS gateway in Washington, reportedly using a brute-force SSH attack against a system without controls limiting repeated login attempts. The intruder then moved through inadequately segmented networks. T-Mobile detected a potential attack on August 12, 2021; security researchers reported a forum sale of the data on August 13, and the company publicly confirmed the breach on August 16.
On August 18, T-Mobile said the attackers had obtained records involving more than 40 million former and prospective customers and 7.8 million current postpaid customers. Exposed information included names, birth dates, Social Security numbers, and driver’s-license or state-ID numbers; business records were also affected. T-Mobile said payment-card data, account passwords, and PINs were not exposed, reset potentially compromised PINs, and offered two years of identity-protection services. The company agreed to a $350 million customer class-action settlement in 2022 and, in 2024, reached a $31.5 million settlement with the FCC covering this and other breaches. Federal prosecutors indicted alleged hacker John Erin Binns on 12 counts, including conspiracy, wire fraud, money laundering, and aggravated identity theft; he remains in Turkey while contesting extradition.
