Breachesby GlyphT-Mobile
Disclosed Oct 9, 202053,800,000 affectedSettled
Cyberattack steals data of tens of millions of T-Mobile customers and applicants
T-Mobile said stolen files held data on about 7.8 million current postpaid accounts and just over 40 million former or prospective customers, including names, birth dates, Social Security numbers and driver's license details.
What is known
| People affected | 53,800,000 (as reported by the organization) |
|---|---|
| Disclosed | Oct 9, 2020 |
| Discovered | Aug 17, 2021 |
| Happened | Aug 12, 2021 |
| Attack | Hacking |
| Data exposed | NamesGovernment IDsSource codeInternal documentsDates of birthSocial Security numbersPhone numbers |
| Sector | Telecom · US |
| Status | Settled |
| Lawsuit or fine | $350M class action settlement plus $150M security spending commitment (2022) (about $350M) |
Sources
Notice letter filed with the Delaware DOJ: T-MobileLapsus$ hackers targeted T-Mobile source code in latest data breachT-Mobile 8-K Ex. 99.1 (August 18, 2021)T-Mobile 8-K on class action settlement (July 22, 2022)Indiana Attorney General 2021 data breach report: T-MobileIndiana Attorney General 2020 data breach report: T‐Mobile
Notices filed
Other breaches at T-Mobile
Breach, details not statedBreach notice filed with the Indiana AG, details not stated.2 affectedTelecomUSAug 29, 2025Abused API leaks account data of 37 million T-Mobile customersHacking exposed names, addresses, emails, phone numbers and dates of birth. Reported to the Indiana AG.Hacking37M affectedTelecomUSJan 19, 2023Breach, details not statedExposed names, Social Security numbers, government IDs, addresses and names. Reported to the Maine AG.TelecomUSDec 31, 2013
History of this record
empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Report-2020.pdfby backfillSource
2021-02-09 to 2020-10-09by backfillSource
2021-08-18 to 2021-02-09by backfillSource
confirmed to settledby seedSource
empty to 350000000by seedSource
empty to $350M class action settlement plus $150M security spending commitment (2022)by seedSource
["names","government-id","source-code","internal-docs"] to ["names","government-id","source-code","internal-docs","dob","ssn","phone"]by seedSource
2021-08-19 to 2021-08-18by seedSource
T-Mobile said a bad actor used stolen credentials to access internal systems housing operational tools software, and that the intrusion was quickly shut down. KrebsOnSecurity reported the Lapsus$ group stole source code for a range of T-Mob to T-Mobile said stolen files held data on about 7.8 million current postpaid accounts and just over 40 million former or prospective customers, including names, birth dates, Social Security numbers and driver's license details.by seedSource
Lapsus$ uses stolen credentials to access T-Mobile internal tools and source code to Cyberattack steals data of tens of millions of T-Mobile customers and applicantsby seedSource
unknown to hackingby seedSource
["names","government-id"] to ["names","government-id","source-code","internal-docs"]by seedSource
empty to T-Mobile said a bad actor used stolen credentials to access internal systems housing operational tools software, and that the intrusion was quickly shut down. KrebsOnSecurity reported the Lapsus$ group stole source code for a range of T-Mobby seedSource
empty to Lapsus$ uses stolen credentials to access T-Mobile internal tools and source codeby seedSource
First recordedby backfillSource
First seen 2026-09-25 (Delaware DOJ), confirmed by Delaware DOJ. Record counts are as reported. Not legal advice.