- A 2021 T-Mobile data leak exposed millions of customer’s data
- Washington State is now suing the telecoms giant
- The suit alleges that T-Mobile failed to protect and notify customers
The US state of Washington is taking legal action against telecommunications giant T-Mobile over consumer protections failures following a 2021 data breach which exposed up to 79 million consumers worldwide, including the social security numbers of almost 184,000 customers in the state.
As part of Washington’s lawsuit, the state claims T-Mobile failed to ‘adequately secure sensitive personal information of more than 2 million Washingtonians’. This failure, the state claims, left those consumers vulnerable to fraud and identity theft.
The suit claims that the breach was ‘entirely avoidable’ and explains T-Mobile had years to fix key vulnerabilities in its cybersecurity systems, and failed to properly address them. A lack of security monitoring meant T-Mobile was unaware of the breach.
T-Mobile customers mislead
The suit alleges T-Mobile deliberately downplayed the severity of the breach to affected consumers, and omitted critical information, which in turn affected customer’s ability to ‘adequately assess their risk of identity theft or fraud’.
The firm sent out texts to affected customers, but failed to include legally required information. Customers who didn’t have their card details or social security numbers compromised were informed of such, but those who did, weren’t given any information about the exposure.
According to the suit, T-Mobile used ‘weak credentials’ and an ‘easily guessable username and password’, and the exposed data appeared for sale on the dark web almost immediately after it was stolen.
T-Mobile has recently agreed to pay an over $15 million penalty to the FCC as part of a settlement deal following a string of high-profile data breaches between 2021 and 2023. The company was also ordered to make significant changes to its cybersecurity infrastructure, and adopt more robust identity and access management frameworks.
Leave a comment