Breachesby GlyphT-Mobile
Disclosed Jan 19, 202337,000,000 affectedConfirmed
Abused API leaks account data of 37 million T-Mobile customers
T-Mobile said a bad actor pulled customer data through a single API starting around November 25, 2022, until it was detected on January 5, 2023. Name, billing address, email, phone, date of birth and account details for about 37 million postpaid and prepaid accounts were obtained, but no payment or Social Security data.
What is known
| People affected | 37,000,000 (as reported by the organization) |
|---|---|
| Disclosed | Jan 19, 2023 |
| Discovered | Jan 5, 2023 |
| Happened | Feb 24, 2023 |
| Attack | Hacking |
| Data exposed | NamesAddressesEmailsPhone numbersDates of birthOther |
| Sector | Telecom · US |
| Status | Confirmed |
Sources
Notices filed
Other breaches at T-Mobile
Breach, details not statedBreach notice filed with the Indiana AG, details not stated.2 affectedTelecomUSAug 29, 2025Cyberattack steals data of tens of millions of T-Mobile customers and applicantsHacking exposed names, government IDs, source code, internal documents, dates of birth, Social Security numbers and phone numbers. Reported to the Delaware DOJ.Hacking54M affectedTelecomUSOct 9, 2020Breach, details not statedExposed names, Social Security numbers, government IDs, addresses and names. Reported to the Maine AG.TelecomUSDec 31, 2013
History of this record
First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.