ClosedHighNo fix needed
T-Mobile: API abused to pull data on 37M accounts
T-Mobile US
T-Mobile said an attacker had abused a single API since around Nov 25, 2022. They pulled names, billing addresses, emails, phone numbers, birth dates and plan details for about 37 million accounts until T-Mobile detected it on Jan 5, 2023.
Why this severity: Data breach via API abuse
- Started
- Jan 5, 2023
- Closed
- Jan 19, 2023
Affected
Not published yet
Fixed in
No fixed release yet
Timeline2
Advisories1
Notes & caveats
Abuse began around Nov 25, 2022 per the 8-K; startedAt is detection.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
