T-Mobile US Breach Exposes Personal Data of ~76.6 Million People
In August 2021 T-Mobile US confirmed a breach, later sized at about 76.6 million current, former and prospective customers, exposing names, dates of birth, Social Security numbers and driver's licence data; John Binns, a US citizen living in Turkey, claimed responsibility.
02Deep-Dive Technical Analysis
Binns told the Wall Street Journal he found an unprotected router exposed to the Internet in July 2021 while scanning T-Mobile's address space; some reports describe it as a GPRS/test gateway. From that foothold he reached the carrier's data center near East Wenatchee, Washington, and used credentials found on internal systems to access more than 100 servers holding customer data. Exposed records reportedly also included IMEI/IMSI identifiers and account PINs, data useful for SIM-swap fraud. T-Mobile became aware around mid-August 2021 after the data was advertised for sale.
03Vulnerability & Exploit Flow
An Internet-exposed, unprotected network device gave a foothold for credential-based lateral movement into customer databases.
04Recommended Defense & Mitigation Protocol
External attack-surface management, credential vaulting, segmentation of subscriber databases and encryption of PII at rest.
05Security Impact & Geopolitical Consequence
Led to a $350 million class-action settlement plus a $150 million security-spending commitment, a 2024 FCC settlement covering several T-Mobile breaches, and US charges against Binns.
06Authoritative Standards & External References
07Related Topic Cluster Records
Master 5G Core, SS7 Defense & Subsea Cable Auditing
Ready to turn your historical knowledge into certified hands-on expertise? Register free on TelcoSec Academy to access interactive lab challenges, or consult our enterprise team for carrier-grade signaling assessments and portable BTS hardware.