T-Mobile warns of identity risk from second breach in 2023

A new data breach from T-Mobile

The carrier announced its first breach for 2023 in January but was able to shut down the attack within 24 hours. In the second one, however, hackers had access to hundreds of customers' personal information for over a month, according to Bleeping Computer.

The breach started in late February 2023 and, fortunately, only affects 868 customers. T-Mobile stated that although the attackers did not obtain call records or personal financial account information, the exposed personally identifiable information is sufficient for identity theft.

Exposed information could include full names, contact information, account numbers and associated phone numbers, account PINs, social security numbers, government IDs, date of birth, balance due, internal codes that T-Mobile uses to service customer accounts, and the number of lines on an account.

T-Mobile has reset the account PINs for affected customers and is now providing them with two years of free credit monitoring and identity theft detection services via Transunion's myTrueIdentity service.

"In March 2023, the measures we have in place to alert us to unauthorized activity worked as designed, and we were able to determine that a bad actor gained access to limited information from a small number of T-Mobile accounts between late February and March 2023," the company said in data breach notification letters sent to affected customers.

Seven other data breaches have been reported by the mobile carrier since 2018.