T-Mobile has revealed that a malicious actor accessed the personal information of 37 million existing prepaid and postpaid customer accounts through one of its Application Programming Interfaces (APIs), in one of its largest data breaches.
See also: New “Blank Image” attack hides phishing scripts in SVG files
An API is a powerful tool that applications and computers can use to communicate seamlessly with each other. It is the bridge between technologies, enabling simple yet effective communication.
To securely allow external partners to access internal data, many web services have resorted to the use of APIs and authentication tokens. This ensures that only approved applications can access the information stored on their servers.
T-Mobile did not disclose the details of how its API was compromised, but threat actors typically discover security vulnerabilities that allow them to retrieve information without requiring authentication.
New data breach affects 37 million accounts
On Thursday, T-Mobile revealed that the relevant API had been compromised in late November 2022. The mobile carrier detected the malicious activity on January 5, 2023, and cut off the attacker's access to the API a day later.
The company assured customers that no sensitive data, such as driver's license numbers, social security numbers/tax ID numbers, passwords/PIN numbers, payment card information (PCI) or other financial account information was leaked due to the API breach.
T-Mobile clarified that the affected API only provided a limited amount of customer account information, including name, billing address, email address, phone number, date of birth, and T-Mobile account data.
In an official press release, the company stated that “key customer information” was leaked during the security breach.
See also: PayPal: Accounts compromised through credential stuffing attack
By reporting the incident to federal agencies, T-Mobile is now working with law enforcement to investigate and resolve the breach.
In addition, the entity is now notifying customers whose confidential information may have been compromised.
While the investigation is still ongoing, it appears that the malicious activity has been completely isolated and there is no evidence of any systems being compromised or tampered with . As far as T-Mobile knows at this time, everything appears to be safe at this point.
See also: Bitzlato founder arrested for money laundering
T-Mobile's eighth data breach since 2018
It's been a tumultuous year for T-Mobile, as this is the first disclosed data breach of 2023, but unfortunately not the first since 2018. In fact, there have been seven other breaches in that time frame, with one of them being particularly serious: attackers gained access to 3% of all customers' personal information!
In 2019, T-Mobile customer data was exposed. Unknown threat actors also accessed T-Mobile employee email accounts in March 2020.
In December 2020, malicious actors gained access to confidential customer information, such as phone numbers and call logs. Then, in February 2021, these attackers compromised an internal T-Mobile application.
Months later, in August 2021, hackers exploited T-Mobile's flawed system and breached its test environments.
Even after paying $270,000 through a third-party company to stop the August 2021 breach, the company was unable to prevent the stolen data online.
Finally, in April 2022, the company officially stated that its network had been infiltrated by Lapsus$, a notorious hacking group known for its cyber extortion. They had access to the company's data through stolen credentials.
Information source: bleepingcomputer.com
