T-Mobile Sued by Washington State Over 2021 Data Breach

The state attorney general in the home state of U.S. telecom giant T-Mobile sued the firm for a 2021 breach that exposed the personal details of more than 79 million current and former customers.

See Also: OnDemand Webinar | AI & Automation for Compliance Strategy: Trends, Measures & Regulations

The Bellevue, Washington-based mobile communications operator has earned a reputation for data breaches, undergoing several multiple data spills in recent years, including in 2017, 2018, 2019, 2020, December 2021 and April 2022.

The focus of Washington state’s complaint, filed Monday in federal court, centers on a breach first confirmed by the telecom on Aug. 17, 2021. The lawsuit accuses T-Mobile of misleading the public with false assurances on its cybersecurity, stating that it failed to adhere to its own standards for protecting data, as well as not living up to recognized industry standards. The firm “ignored its own internal reports that warned of the vulnerabilities that eventually led to and exacerbated the August breach,” state prosecutors wrote.

Exposed information included millions of Social Security numbers, names and physical addresses, phone numbers, driver’s license information and devices’ unique International mobile equipment identity numbers.

“This significant data breach was entirely avoidable,” said Washington Attorney General Bob Ferguson. “T-Mobile had years to fix key vulnerabilities in its cybersecurity systems – and it failed.”

The breach has already been the focus of a probe by the Massachusetts state attorney general, as well as the U.S. Federal Communications Commission. In September 2024, T-Mobile settled the FCC probe by agreeing to pay a $15.8 million civil penalty over cybersecurity incidents in 2021, 2022 and 2023. The company also pledged to overhaul its infrastructure, including implementing zero trust approaches as well as phishing-resistant multi-factor authentication.

T-Mobile said the new lawsuit was a “surprise,” and that it’s been in discussions with the Washington attorney general’s office since 2021 over the breach, and most recently sought to continue that dialogue last November. “While we disagree with their approach and the filing’s claims, we are open to further dialogue and welcome the opportunity to resolve this issue, as we have already done with the FCC,” T-Mobile said in a statement. “We also look forward to sharing how T-Mobile has fundamentally transformed our approach to cybersecurity over the past four years to further protect our customers.”

The Washington state lawsuit further alleges that T-Mobile failed to correctly inform affected current and consumers, and sent different messaging to each that in some cases “misled” and “minimized the perceived impact of the breach.” This included the company failing to notify victims whose Social Security number was exposed to that fact, and instead only informing victims whose Social Security number hadn’t been exposed, of that fact.

The state said the telecom’s failure to correctly notify millions of victims, as well as failing to notify them using more than an electronic notification, left them at risk. “If customers had been appropriately notified, they could have taken steps to protect themselves, such as by obtaining credit monitoring, setting up fraud alerts or getting a security freeze,” according to the lawsuit.

“T-Mobile continued to downplay the severity of the breach. For example, in T-Mobile’s 2021 Annual Report to its shareholders, published in February 2022, T-Mobile spent more time reporting what was not exposed in the breach rather than elaborating on the vast amount of PII that was exposed and remained on the dark web to that day.”

Five Month Breach

Hackers first penetrated T-Mobile’s infrastructure in March 2021, until being ejected on Aug. 12, 2021, according to the lawsuit. “Due to a lack of adequate security monitoring,” it alleges, “T-Mobile was unaware of the breach until an anonymous outside source notified the company that its customers’ data was posted for sale on the dark web.”

The person who claimed to breach T-Mobile later told Information Security Media Group they’d used brute-force and credential-stuffing attacks to gain access to over 100 servers and steal data pertaining to more than 100 million individuals, including 30 million Social Security and driver’s license numbers. They advertised a complete copy of the stolen information for sale, for 6 bitcoins, then worth $286,000, and as of Tuesday worth about $600,000.

“In simplest terms, the bad actor leveraged their knowledge of technical systems, along with specialized tools and capabilities, to gain access to our testing environments and then used brute-force attacks and other methods to make their way into other IT servers that included customer data,” said Mike Sievert, CEO of T-Mobile, at the time.

Credit for the attack was quickly taken by an individual using the Telegram alias Anton Lyashevesky and the Twitter handle @Intelsecrets, who also went by the name John Erin Binns and “Irdev.”

In May 2024, Turkish law enforcement arrested Binns, based on a 12-count U.S. criminal indictment charging him with being behind the T-Mobile hack attack. In November 2024, the U.S. unsealed an indictment charging Binns and Canadian national Connor Riley Moucka with stealing terabytes of data from cloud platform Snowflake in a major breach impacting over 165 organizations and involving roughly 50 billion call and text records, as well as extorting “at least 36 bitcoin” – worth $3.6 million as of Tuesday – from victims.

The U.S. is seeking the extradition of both Binns and Moucka, who was arrested by Canadian police last November.

Signs of Cybersecurity Improvement

T-Mobile’s cybersecurity infrastructure may now be on firmer footing. In November 2024, T-Mobile said it was among the telecoms targeted by the Chinese nation-state hacking group tracked as Salt Typhoon. The White House said the hackers successfully penetrated at least nine U.S. telecoms’ infrastructures, also including AT&T, Charter Communications, Consolidated Communications, Lumen Technologies and Verizon Communications. In some cases, the attackers stole voluminous amounts of metadata, as well as intercepted telephone calls involving high-level government and political officials.

In T-Mobile’s case, the company said its investigation found that the Salt Typhoon attackers failed to obtain any sensitive customer information before being spotted and ejected.

“Simply put, our defenses worked as designed – from our layered network design to robust monitoring and partnerships with third-party cyber security experts and a prompt response – to prevent the attackers from advancing and, importantly, stopped them from accessing sensitive customer information,” T-Mobile said. “Other providers may be seeing different outcomes.”