{"id":639,"date":"2023-04-23T13:33:24","date_gmt":"2023-04-23T18:33:24","guid":{"rendered":"https:\/\/kentprotect.com\/?p=639"},"modified":"2023-04-24T00:09:38","modified_gmt":"2023-04-24T05:09:38","slug":"breach-report-t-mobile-data-breach-lasts-over-a-month-affects-37-million-potentially-implicates-third-parties-like-google-fi","status":"publish","type":"post","link":"https:\/\/kentprotect.com\/index.php\/2023\/04\/23\/breach-report-t-mobile-data-breach-lasts-over-a-month-affects-37-million-potentially-implicates-third-parties-like-google-fi\/","title":{"rendered":"Breach Report: 2022 T-Mobile data breach lasts over a month, affects 37 million, potentially implicates third-parties like Google Fi"},"content":{"rendered":"
<\/div>\n

One-sentence summary: <\/strong><\/p>\n\n\n\n

T-Mobile suffered a data breach for over a month starting in November 2022, affecting over 37 million customers and potentially implicating Google Fi customers.<\/p>\n\n\n\n

Who was involved?<\/strong><\/p>\n\n\n\n

T-Mobile, 37 million T-Mobile customers, potentially Google Fi, and a threat actor. <\/p>\n\n\n\n

What was the timeline?<\/strong><\/p>\n\n\n\n

November 25, 2022: Threat actor starts abusing T-Mobile API <\/p>\n\n\n\n

January 5, 2023: T-Mobile discovers the breach <\/p>\n\n\n\n

January 6, 2023: Breach is stopped by T-Mobile after initiating an incident response <\/p>\n\n\n\n

January 19, 2023: T-Mobile reports the breach in its January 2023 Form 8-K filing and makes a public notice on its website<\/p>\n\n\n\n

January 30, 2023: Google Fi informs its affected customers of a breach temporally associated with T-Mobile’s breach<\/p>\n\n\n\n

What occurred?<\/strong><\/p>\n\n\n\n

In November 2022, a threat actor obtained access to T-Mobile’s API and abused it to potentially breach the following data of over 37 million individuals: “customer account data, including name, billing address, email, phone number, date of birth, T-Mobile account number and information such as the number of lines on the account and plan features” (T-Mobile, 2023, p. 2). Google Fi later confirmed some of its customers were involved in a data breach that is temporally associated with this breach (Page, 2023). <\/p>\n\n\n\n

Estimated costs:<\/strong><\/p>\n\n\n\n

Associated incident response costs, breach notification costs, “external cybersecurity experts” <\/p>\n\n\n\n

Involved laws: <\/strong><\/p>\n\n\n\n

TBA or N\/A (see disclaimer)<\/p>\n\n\n\n

Root cause: <\/strong><\/p>\n\n\n\n

TBA or N\/A (see disclaimer)<\/p>\n\n\n\n

Lessons learned: <\/strong><\/p>\n\n\n\n

T-Mobile suffered a similar data breach in 2018<\/a> when it was discovered to have a publicly exposed API allowing any person to retrieve significant account information with just a phone number. Thus, it appears T-Mobile fell victim to a similar attack again where it enabled a publicly exposed API and thus was a misconfiguration. Having multiple people, such as a doer and checker, to evaluate changes in production can prove invaluable in detecting potential misconfigurations, such as a publicly exposed service or portal. Additionally, publicly-facing vulnerability assessments could also potentially discover such vulnerabilities. Finally, internal threat hunting, such as monitoring internal IIS logs to see repeated, EXTERNAL requests for that API query could have led to an earlier discovery. Public and private services should be tagged\/labeled within an organization and clearly delimited for easier prevention and detection of data breaches. <\/p>\n\n\n\n

Sources: <\/strong><\/p>\n\n\n\n

Page, C. (2023, January 31). TechCrunch is part of the Yahoo family of brands<\/em>. TechCrunch. Retrieved April 23, 2023, from https:\/\/techcrunch.com\/2023\/01\/31\/google-fi-customer-data-breach\/<\/p>\n\n\n\n

T-Mobile. (2020, June). T-Mobile_New_Logo_Primary_RGB_M-on-W.jpg<\/em>. https:\/\/www.t-mobile.com\/news\/_admin\/uploads\/2020\/06\/T-Mobile_New_Logo_Primary_RGB_M-on-W.jpg<\/p>\n\n\n\n

T-Mobile. (2023). FORM 8-K. In SEC EDGAR<\/em> (No. 1\u201333409). UNITED STATES  SECURITIES AND EXCHANGE COMMISSION. Retrieved April 23, 2023, from https:\/\/www.sec.gov\/Archives\/edgar\/data\/1283699\/000119312523010949\/d641142d8k.htm<\/p>\n\n\n\n

T-Mobile Newsroom. (2023). T-Mobile Informing Impacted Customers about Unauthorized Activity. T-Mobile Newsroom<\/em>. https:\/\/www.t-mobile.com\/news\/business\/customer-information<\/p>\n\n\n\n

\n