https://pwn.watch/t/t-mobile Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 19 Jan 2023 00:00:00 GMT https://pwn.watch/i/t-mobile-api-breach-37-million-2023 https://pwn.watch/i/t-mobile-api-breach-37-million-2023 Thu, 19 Jan 2023 00:00:00 GMT high <p>T-Mobile said an attacker had abused a single API since around Nov 25, 2022. They pulled names, billing addresses, emails, phone numbers, birth dates and plan details for about 37 million accounts until T-Mobile detected it on Jan 5, 2023.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> no-fix-needed</p> <p><strong>Latest updates:</strong></p><ul><li>2023-01-19: T-Mobile 8-K filing discloses about 37 million affected accounts (<a href="https://www.sec.gov/Archives/edgar/data/1283699/000119312523010949/d641142d8k.htm">source</a>)</li><li>2023-01-05: T-Mobile detects the API abuse and stops it within a day (<a href="https://www.sec.gov/Archives/edgar/data/1283699/000119312523010949/d641142d8k.htm">source</a>)</li></ul>