In August 2021, T-Mobile disclosed that customer information from a wider cyberattack had been compromised, affecting up to 52,000 current Metro by T-Mobile accounts. The disclosure identified Metro customers as part of the incident’s scope, but T-Mobile said the exposed data did not include Social Security numbers or financial details. Former Sprint Corporation Prepaid and Boost Mobile customers were reportedly not affected.
The incident demonstrated the privacy risks of operating Metro as a prepaid brand within T-Mobile’s broader systems: customer information could be reached through an attack directed at the parent company rather than Metro’s standalone retail operations. The source does not describe a fine, lawsuit, regulator finding, or executive discipline arising from the breach. It does, however, record the company’s public disclosure and the limited nature of the data T-Mobile said was exposed. Metro had roughly 20 million subscribers in 2021, making the affected accounts a small portion of its base, but the episode added to earlier security concerns: in November 2015, researchers Eric Taylor and Blake Welsh found that Metro’s payment portal could reveal a customer’s address, phone model and serial number, and billing plan using only a phone number; Metro subsequently patched that vulnerability.
