T-Mobile US Inc. (NYSE: TMUS) is looking into claims of a hacker trying to sell personal data of over 100 million customers for around $270,000. On Sunday, Motherboard revealed that a hacker was selling throngs of personal data that the seller said was obtained from the T-Mobile server.
Hacker selling T-Mobile customers’ data
The seller's data included phone numbers, social security numbers, physical addresses, driver license information, names, and unique IMEI numbers. Motherboard contacted the seller and authenticated that the data was from T-Mobile customers.
In an online chat with Motherboard, the seller said they had compromised several T-Mobile servers and obtained the full customer information. Interestingly, in the underground platform where the hacker is selling the data, they ask for 6 BTC, which is approximately $280,000 at the current rate BTC price, for a data subset containing 30 million driver licenses and social security numbers. For now, the seller is privately selling the remaining data.
The seller explained that T-Mobile might have realized that they had been breached. However, the hacker said, "I think they already found out because we lost access to the backdoored servers." In addition, the desire T-Mobile kicking the hacker out of the server the seller had downloaded the information locally and backed it up in various spaces.
T-Mobile told Motherboard, “We are aware of claims made in an underground forum and have been actively investigating their validity. We do not have any additional information to share at this time.”
T-Mobile a target of cyberattacks
If the claims are valid, this will be a massive blow to the company's cybersecurity that has been hit with a slew of cyber-attacks in recent years resulting in data loss. In February, a customer who suffered a SIM-swap attack and lost around $450,000 in BTC sued T-Mobile. In the suit, Calvin Cheng, the victim, accused the carrier of failing to implement sufficient security measures to protect customers' accounts. In July last year, a crypto firm CEO also sued the company because of SIM-swaps that led to losing $8.7 million worth of crypto.