Hackers have stolen personal information from 15 million T-Mobile subscribers, the company announced on Thursday. The breach occurred through credit reporting agency Experian.
The hack affects applicants who required a credit check for service or device financing from Sept. 1, 2013, through Sept. 16, 2015. In a statement, Experian said the information the hackers obtained “included names, dates of birth, addresses, and Social Security numbers and/or an alternative form of ID like a drivers’ license number, as well as additional information used in T-Mobile’s own credit assessment.”
The company clarified that the hackers did not obtain information from Experian’s consumer credit information database. The breach “was discovered within two days, secured immediately, comprehensive forensic investigation launched (and still continuing) and we announced it today to quickly notify consumers. Our notification to state attorneys general happens tomorrow,” Experian spokeswoman Susan Henson told USA Today on Thursday.
T-Mobile was quick to blame Experian. “I am incredibly angry about this data breach and we will institute a thorough review of our relationship with Experian,” said T-Mobile CEO John Legere. “I take our customer and prospective customer privacy VERY seriously … I do want to assure our customers that neither T-Mobile’s systems nor network were part of this intrusion and this did not involve any payment card numbers or bank account information.”
The information obtained means that the hackers will likely need to contact victims, posing as T-Mobile or Experian, in order to reap financial rewards. In a statement, Experian reaffirmed that it would not contact victims with requests for personal information.
“Consumers should note that under no circumstances will Experian or T-Mobile call you or send you a message and ask for your personal information in connection with this incident. You may go to the website, but you should not provide personal information to anyone who calls you or sends you a message about this incident,” the statement said.
Experian said it would provide two years of free credit reporting to applicants who applied for T-Mobile service during the affected period, and apologized for the incident. “We sincerely apologize for the concern and stress that this event may cause,” said Craig Boundy, the CEO of Experian’s North America branch. “That is why we’re taking steps to provide protection and support to those affected by this incident and will continue to coordinate with law enforcement during its investigation.”
