[BreachExchange] T-Mobile says hackers accessed some customer call records in data breach

[Destry Winant]

https://techcrunch.com/2021/01/03/t-mobile-call-records-data-breach/

T-Mobile,  the third largest cell carrier in the U.S. after completing
its recent $26 billion merger with Sprint, ended 2020 by announcing
its second data breach of the year.

The cell giant said in a notice buried on its website that it recently
discovered unauthorized access to some customers’ account information,
including the data that T-Mobile makes and collects on its customers
in order to provide cell service.

>From the notice: “Our cybersecurity team recently discovered and shut
down malicious, unauthorized access to some information related to
your T-Mobile account. We immediately started an investigation, with
assistance from leading cybersecurity forensics experts, to determine
what happened and what information was involved. We also immediately
reported this matter to federal law enforcement and are now in the
process of notifying impacted customers.”

Known as customer proprietary network information (CPNI), this data
can include call records — such as when a call was made, for how long,
the caller’s phone number and the destination phone numbers for each
call, and other information that might be found on the customer’s
bill.

But the company said that the hackers did not access names, home or
email addresses, financial data, and account passwords (or PINs).

A spokesperson for T-Mobile said the breach happened in early
December, and affects about 0.2% of all T-Mobile customers — or
approximately 200,000 customers.

It’s the latest security incident to hit the cell giant in recent years.

In 2018, T-Mobile said as many as two million customers may have had
their personal information scraped. A year later, the company
confirmed hackers accessed records on another million prepaid
customers. Just months into 2020, T-Mobile admitted a breach on its
email systems that saw hackers access some T-Mobile employee email
accounts, exposing some customer data.