T-Mobile blames reseller for April data breach that compromised employee records

US telecom giant T-Mobile has claimed innocence about a major leak of employee records that took place in April, stating that the breach was suffered by an authorised reseller. 

Researchers at VX-Underground, the largest collection of malware source code, samples, and papers on the internet, recently said they were contacted by groups of threat actors going by the name “Doubl” and “Emo” who intended to share information concerning a data security incident that took place at T-Mobile in April this year.

“Hello, prepare yourself for another long post about the new T-Mobile breach and a mistake that we made. Mistake: Employee PII was leaked, NOT customer PII. This is the 2nd time a T-Mobile breach has exposed T-Mobile employees.

“We’ve had a large number of people asking how we knew about the T-Mobile breach and, as is tradition, we knew because the people responsible for it (leaking) notified us,” VX-Underground said in a post on X, formerly Twitter.

 

“However, it is already being discussed on forums. Unlike previous times we’re given information prior to its "official" media announcement, we can do more than "trust me, bro". The breach was performed by an individual named "Doubl". The information was leaked by an individual named "Emo",” it added.

According to the threat actors, the breach that occurred in April wasn’t disclosed until September this year.

“This breach occurred shortly after the 2nd breach of this year, which occurred in March, 2023. We do not know why it took the Threat Actor(s) several months to leak the data, we can only speculate, so we will not,” VX-Underground added.

According to VX-underground, the 90 GB of stolen data containing employee records were reportedly being shared on criminal forums including BreachForum and spread throughout Telegram and Discord.

According to the data shared on dark web marketplaces, the breach goes back to April this year when Connectivity Source, an independently-owned dealer that uses T-Mobile branding and sells wireless handsets, watches and tablets suffered a data security incident. The compromised data included employee IDs, dates of hiring and firing, employee login details, Social Security numbers, and service account details for employees.

In a statement shared with the media, a T-Mobile spokesperson said, “There has not been a T-Mobile data breach. The data being referred to online is believed to be related to an independently owned authorised retailer from their incident earlier this year. T-Mobile employee data was not exposed.”

The news of the employee data leak comes within a week of the telecom giant suffering another data security incident when customers started reporting that they could see other peoples’ details after logging in to their accounts.

According to social news aggregator site Reddit, the news of the data leak started pouring in around 3AM Eastern Standard Time when customers reported that they were able to view other peoples’ information on the “Bill” tab. Not only this, the “More” tab, where payment details and other sensitive data is stored, was also showing other peoples’ information.