T-Mobile
Disclosed Jan 19, 20233 years ago37,000,000 affectedConfirmed
Abused API leaks account data of 37 million T-Mobile customers
T-Mobile said a bad actor pulled customer data through a single API starting around November 25, 2022, until it was detected on January 5, 2023. Name, billing address, email, phone, date of birth and account details for about 37 million postpaid and prepaid accounts were obtained, but no payment or Social Security data.
What is known
| People affected | 37,000,000 (as reported by the organization) |
|---|---|
| Disclosed | Jan 19, 2023 |
| Discovered | Jan 5, 2023 |
| Happened | Feb 24, 2023 |
| Attack | Hacking |
| Data exposed | Names, Addresses, Emails, Phone numbers, Dates of birth, Other |
| Sector | Telecom · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| T-Mobile says hacker accessed personal data of 37 million customerstechcrunch.com · News | News |
| T-Mobile US, Inc. Form 8-K, January 19, 2023sec.gov · SEC filing | SEC filing |
| Indiana Attorney General 2023 data breach report: T‐Mobilein.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | Jan 19, 2023 | 37,000,000 |
| Indiana AGresidents of IN | Apr 28, 2023 | 7 |
Other breaches at T-Mobile
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Disclosed Aug 29, 2025Aug 29, 20251 year ago | Aug 29, 20251 year ago | Not stated | Telecom | Confirmed | 2 |
| Cyberattack steals data of tens of millions of T-Mobile customers and applicantsOct 9, 20205 years agoHacking | Oct 9, 20205 years ago | Hacking | Telecom | Settled | 54M |
| Disclosed Dec 31, 2013Dec 31, 201312 years ago | Dec 31, 201312 years ago | Not stated | Telecom | Confirmed | Unknown |
History of this record
First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.