Cyber Security Threat Summary:
Today, T-Mobile customers said they could see other peoples' account and billing information after logging into the company's official mobile application. According to user reports on social media, the exposed information included customers' names, phone numbers, addresses, account balances, and credit card details like the expiration dates and the last four digits. As first reported by The Verge, some of the customers affected by this issue could see the sensitive information of multiple other people while logged into their own accounts. While a massive number of reports started surfacing earlier today on Reddit and Twitter, some T-Mobile customers also claimed that they've been experiencing this throughout the last two weeks. ‘Reported this issue when it first popped up here on Reddit over 2 weeks ago and sent pics of the other person's info to their security team. No response, but wow, just wow,’ one customer said. ‘I have brought this issue up with T-Mobile representatives in the past, as well as my issue with being routed to metro activation line when my phone services are suspended,’ another added” (Bleeping Computer, 2023).

Security Officer Comments:
T-Mobile has a history of data breaches, with the Telecom company recently disclosing in May its second data breach for this year, after hundreds of customers had their PII data exposed between February and March 2023 with threat actors hacking into the carrier’s systems. T-Mobile noted that the latest incident was not a cyberattack and that its systems were not breached. Rather, the company stated that there was a temporary system glitch due to an overnight technology update. Approximately 100 individuals were impacted due to the glitch, with T-Mobile quickly resolving the issue.

Suggested Correction(s):
With PII data for multiple users being accessible on some accounts, impacted users should monitor their finances for suspicious activity and be on the lookout for targeted social engineering and phishing attacks.

Link(s):
https://www.bleepingcomputer.com/