T-Mobile has been sued a second time over a 2021 data breach that impacted 80 million T-Mobile users. The consumer protection lawsuit comes from Washington State Attorney General Bob Ferguson, who says that T-Mobile had years to "fix key vulnerabilities" that could have prevented the data breach.
According to Ferguson, T-Mobile knew that its systems had certain cybersecurity vulnerabilities, and the company did not do enough to address them. T-Mobile is also accused of misleading customers about its security practices, not notifying Washingtonians of the data breach in a timely matter, and downplaying the severity of the breach.
For years prior to August 2021, T-Mobile did not meet industry standards for cybersecurity and knew about these vulnerabilities. These included insufficient processes for identifying and addressing security threats and a systemic lack of oversight. In some cases, T-Mobile used obvious passwords to protect accounts that had access to customers' sensitive personal information. The 2021 breach was enabled, in part, when the hacker guessed obvious credentials to gain access to T-Mobile's internal databases.
T-Mobile's systems were breached in March 2021, but T-Mobile did not learn of the attack until August 2021. Hackers were able to obtain names, phone numbers, addresses, birth dates, social security numbers, driver's license and ID info, IMEI numbers, and IMSI numbers from T-Mobile customers, and that data was sold.
The hacker behind the attack said that T-Mobile's security was "awful" and that the breach occurred when an unprotected T-Mobile router was discovered, which led to access of T-Mobile's Washington data center.
T-Mobile apologized for the data breach and promised to prevent a future attack by establishing long-term partnerships with cybersecurity experts.
The lawsuit is seeking restitution for Washingtonians that were harmed in the data breach, along with injunctive relief to require improvements to T-Mobile's cybersecurity practices.
T-Mobile already paid $350 million to settle a class action lawsuit over the data breach in 2022, and it was fined $60 million by the Committee on Foreign Investment in the US (CFIUS) for failing to prevent or disclose unauthorized access to sensitive customer data.