# T-Mobile: API abused to pull data on 37M accounts · pwn.watch

> T-Mobile said an attacker had abused a single API since around Nov 25, 2022. They pulled names, billing addresses, emails, phone numbers, birth dates and plan details for about 37 million accounts until T-Mobile detected it on Jan 5, 2023.

Page: https://pwn.watch/i/t-mobile-api-breach-37-million-2023 · generated 2026-10-22T22:00:08.805Z

## Status
- Severity: high · status: closed · patch: no-fix-needed
- Product: T-Mobile US
- Started: 2023-01-05 · closed: 2023-01-19

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/t-mobile-api-breach-37-million-2023/feed.xml
- JSON Feed: https://pwn.watch/i/t-mobile-api-breach-37-million-2023/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/t-mobile-api-breach-37-million-2023.json
- This file: https://pwn.watch/i/t-mobile-api-breach-37-million-2023/llms.txt

## Updates (newest first)
- 2023-01-19: T-Mobile 8-K filing discloses about 37 million affected accounts (https://www.sec.gov/Archives/edgar/data/1283699/000119312523010949/d641142d8k.htm)
- 2023-01-05: T-Mobile detects the API abuse and stops it within a day (https://www.sec.gov/Archives/edgar/data/1283699/000119312523010949/d641142d8k.htm)

## Fix brief
# Security brief: T-Mobile: API abused to pull data on 37M accounts

Source: https://pwn.watch/i/t-mobile-api-breach-37-million-2023 · status: closed (closed Jan 19, 2023) · severity: high · updated Jan 19, 2023

## Patch status
**NO FIX NEEDED: no action on your side beyond verification.**

## What it is
T-Mobile said an attacker had abused a single API since around Nov 25, 2022. They pulled names, billing addresses, emails, phone numbers, birth dates and plan details for about 37 million accounts until T-Mobile detected it on Jan 5, 2023.

Severity detail: Data breach via API abuse

- Product: T-Mobile US

## Affected versions
- Not specified in the data. Check the advisories below.

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Latest updates
- Jan 19, 2023: T-Mobile 8-K filing discloses about 37 million affected accounts
- Jan 5, 2023: T-Mobile detects the API abuse and stops it within a day

## Advisories
- [T-Mobile US Form 8-K (Jan 19, 2023)](https://www.sec.gov/Archives/edgar/data/1283699/000119312523010949/d641142d8k.htm) (SEC / T-Mobile)

## Write-ups & news
- [T-Mobile data breach exposes about 37 mln accounts](https://www.reuters.com/technology/t-mobile-says-investigating-data-breach-affecting-37-mln-accounts-2023-01-19/)

## Caveats
Abuse began around Nov 25, 2022 per the 8-K; startedAt is detection.

---
Machine-readable: https://pwn.watch/i/t-mobile-api-breach-37-million-2023.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.