Flash Alert: T-Mobile Data Exposure

Flash Alert: T-Mobile Data Exposure

TLP: GREEN

On August 16, 2021, United States-based telecommunications company, T-Mobile, disclosed a data breach that possibly resulted in the compromise of approximately 100 million unique records. The investigation into the breach occurred after an actor posted a thread on a cybercriminal underground forum advertising the sale of breach data and claiming it was from T-Mobile. A second update was shared on August 17, 2021 and confirmed that the ongoing investigation revealed some T-Mobile customer data had been accessed. This data included names, date of birth, Social Security numbers and driver’s licenses.T-Mobile currently estimates that 7.8 million current postpaid customers are affected, as well as over 40 million records of former or potential customers who had previously applied for credit. This is the sixth data breach disclosed by T-Mobile within the past five years.

Standing Intelligence Requirements

For the most up to date list of ZeroFOX Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Review network logs for potential signs of compromise and data egress.
• Enforce administrative or application control restrictions to prevent unauthorized installation of software or media.

Details

On August 14, 2021, an actor using the alias "SubVirt" published a thread on a cybercriminal underground forum selling a breach package containing 30 million unique records of compromised credentials (Figure 1). The seller advertises the data for 6 bitcoin (USD 275,406.00) and claims the data has never been sold before. Those interested in purchasing the breach package are required to contact the actor on a provided Telegram account, with the note that only serious buyers are eligible to purchase the breach package. The actor also includes a snippet of the data included in the breach, such as:

• Names
• Social security numbers
• Date of birth
• Phone numbers
• Addresses
• Security PINs
• Driver license information

Figure 1: Actor "SubVirt" advertises sale of breach package for 6 BTC

The actor responded to the thread on August 16, 2021 claiming that the data was from T-Mobile and is still for sale. The price for the breach package changed from BTC 6 to USD 200. Figure 2 is a screenshot of the latest posts by "SubVirt." Although the price point in the post is a significant drop from the original amount, ZeroFox Threat Intelligence confirmed from a sensitive source with direct access to the actor that the price is actually at USD 200,000. Additionally, the actor revealed that he no longer has access to the source of the data.

Figure 2: "SubVirt" claims that the breach package is from T-Mobile

After this actor posted the advertisement thread, T-Mobile was made aware of the incident and worked to investigate the claims made by the actor and the information involved in the data leak. On August 17, 2021, T-Mobile published an update on the breach investigation. The company continues working through the investigation, but has learned from preliminary analysis that approximately 7.8 million postpaid customer records were included in the breach as well as 40 million records for former or prospective T-Mobile customers. T-Mobile recommends that all postpaid customers change their PIN as a precautionary measure. T-Mobile is also taking proactive steps to help protect their customers by offering two years of identity monitoring to affected customers.