info
Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss
The T-Mobile Data Breach Is One You Can't Ignore
0 views
Skip to first unread message
Leroy N. Soetoro
Aug 17, 2021, 12:31:12 AM8/17/21
to
https://www.wired.com/story/t-mobile-hack-data-phishing/
NOT ALL DATA breaches are created equal. None of them are good, but they
do come in varying degrees of bad. And given how regularly they happen,
it’s understandable that you may have become inured to the news. Still, a
T-Mobile breach that hackers claim involved the data of 100 million people
deserves your attention, especially if you’re a customer of the “un-
carrier.”
As first reported by Motherboard on Sunday, someone on the dark web claims
to have obtained the data of 100 million from T-Mobile’s servers and is
selling a portion of it on an underground forum for 6 bitcoin, about
$280,000. The trove includes not only names, phone numbers, and physical
addresses but also more sensitive data like social security numbers,
driver's license information, and IMEI numbers, unique identifiers tied to
each mobile device. Motherboard confirmed that samples of the data
“contained accurate information on T-Mobile customers.”
A lot of that information is already widely available, even the social
security numbers, which can be found on any number of public records
sites. There’s also the reality that most people’s data has been leaked at
some point or another. But the apparent T-Mobile breach offers potential
buyers a blend of data that could be used to great effect, and not in ways
you might automatically assume.
“This is ripe for using the phone numbers and names to send out SMS-based
phishing messages that are crafted in a way that’s a little bit more
believable,” says Crane Hassold, director of threat intelligence at email
security company Abnormal Security. “That’s the first thing that I thought
of, looking at this.”
Yes, names and phone numbers are relatively easy to find. But a database
that ties those two together, along with identifying someone’s carrier and
fixed address, makes it much easier to convince someone to click on a link
that advertises, say, a special offer or upgrade for T-Mobile customers.
And to do so en masse.
The same is true for identity theft. Again, a lot of the T-Mobile data is
out there already in various forms across various breaches. But having it
centralized streamlines the process for criminals—or for someone with a
grudge, or a specific high-value victim in mind, says Abigail Showman,
team lead at risk intelligence firm Flashpoint.
And while names and addresses may be fairly common grist at this point,
International Mobile Equipment Identity numbers are not. Because each IMEI
number is tied to a specific customer’s phone, knowing it could help in a
so-called SIM-swap attack. “This could lead to account takeover concerns,”
Showman says, “since threat actors could gain access to two-factor
authentication or one-time passwords tied to other accounts—such as email,
banking, or any other account employing advanced authentication security
feature—using a victim’s phone number.”
That’s not a hypothetical concern; SIM-swap attacks have run rampant over
the past several years, and a previous breach, which T-Mobile disclosed in
February, was used specifically to execute them.
T-Mobile confirmed on Monday that a breach had occurred but not whether
customer data had been compromised. “We have been working around the clock
to investigate claims being made that T-Mobile data may have been
illegally accessed,” the company said in an emailed statement. “We have
determined that unauthorized access to some T-Mobile data occurred,
however we have not yet determined that there is any personal customer
data involved. We are confident that the entry point used to gain access
has been closed, and we are continuing our deep technical review of the
situation across our systems to identify the nature of any data that was
illegally accessed.”
FEATURED VIDEO
How to Protect Yourself After a Massive Corporate Hack
Get WIRED + a free tote
SUBSCRIBE NOW
Most Popular
ryan reynolds
CULTURE
Ryan Reynolds Called In a Favor for That Big Free Guy Cameo
ANGELA WATERCUTTER
primal filter + mask
GEAR
18 Face Masks We Actually Like to Wear
ADRIENNE SO
bacteria
CULTURE
Time Travelers Should Be a Lot More Worried About Viruses
GEEK'S GUIDE TO THE GALAXY
Sunisa Lee
SCIENCE
Gymnasts Make the Wolf Turn Look Easy. Physics Shows It’s Not
RHETT ALLAIN
In the meantime, you have a few admittedly limited steps you can take to
protect yourself, or at least limit the potential fallout if all that data
did get stolen. Change your T-Mobile password and security PIN. Companies
that have leaked social security numbers and other especially sensitive
information have in the past offered free credit monitoring to victims, so
keep an eye on communications from T-Mobile to see if it offers the same.
As for stopping SIM-swap attacks, there’s not much you can do against a
determined attacker, but a good first step is to start using app-based
authentication instead of having codes sent to you by text message.
After so many data breaches in recent years, it’s easy to let them drift
by without paying much mind. And it’s true, to a certain extent, that most
of the data you care about is available to hackers. “If I’m going to be
doing some identity theft, most of the information is already out there in
one of the dozens of other data breaches that have happened previously,”
Hassold says.
But it’s still important to focus on the big ones, both to know your
specific risks and to hold companies accountable for their lapses. So far,
shrugging it off hasn’t worked; if the data’s legitimate, this would be T-
Mobile’s sixth known breach in four years.
--
"LOCKDOWN", left-wing COVID fearmongering. 95% of COVID infections
recover with no after effects.
No collusion - Special Counsel Robert Swan Mueller III, March 2019.
Officially made Nancy Pelosi a two-time impeachment loser.
Donald J. Trump, cheated out of a second term by fraudulent "mail-in"
ballots. Report voter fraud: sf.n...@mail.house.gov
Thank you for cleaning up the disaster of the 2008-2017 Obama / Biden
fiasco, President Trump.
Under Barack Obama's leadership, the United States of America became the
The World According To Garp. Obama sold out heterosexuals for Hollywood
queer liberal democrat donors.
President Trump boosted the economy, reduced illegal invasions, appointed
dozens of judges and three SCOTUS justices.
NOT ALL DATA breaches are created equal. None of them are good, but they
do come in varying degrees of bad. And given how regularly they happen,
it’s understandable that you may have become inured to the news. Still, a
T-Mobile breach that hackers claim involved the data of 100 million people
deserves your attention, especially if you’re a customer of the “un-
carrier.”
As first reported by Motherboard on Sunday, someone on the dark web claims
to have obtained the data of 100 million from T-Mobile’s servers and is
selling a portion of it on an underground forum for 6 bitcoin, about
$280,000. The trove includes not only names, phone numbers, and physical
addresses but also more sensitive data like social security numbers,
driver's license information, and IMEI numbers, unique identifiers tied to
each mobile device. Motherboard confirmed that samples of the data
“contained accurate information on T-Mobile customers.”
A lot of that information is already widely available, even the social
security numbers, which can be found on any number of public records
sites. There’s also the reality that most people’s data has been leaked at
some point or another. But the apparent T-Mobile breach offers potential
buyers a blend of data that could be used to great effect, and not in ways
you might automatically assume.
“This is ripe for using the phone numbers and names to send out SMS-based
phishing messages that are crafted in a way that’s a little bit more
believable,” says Crane Hassold, director of threat intelligence at email
security company Abnormal Security. “That’s the first thing that I thought
of, looking at this.”
Yes, names and phone numbers are relatively easy to find. But a database
that ties those two together, along with identifying someone’s carrier and
fixed address, makes it much easier to convince someone to click on a link
that advertises, say, a special offer or upgrade for T-Mobile customers.
And to do so en masse.
The same is true for identity theft. Again, a lot of the T-Mobile data is
out there already in various forms across various breaches. But having it
centralized streamlines the process for criminals—or for someone with a
grudge, or a specific high-value victim in mind, says Abigail Showman,
team lead at risk intelligence firm Flashpoint.
And while names and addresses may be fairly common grist at this point,
International Mobile Equipment Identity numbers are not. Because each IMEI
number is tied to a specific customer’s phone, knowing it could help in a
so-called SIM-swap attack. “This could lead to account takeover concerns,”
Showman says, “since threat actors could gain access to two-factor
authentication or one-time passwords tied to other accounts—such as email,
banking, or any other account employing advanced authentication security
feature—using a victim’s phone number.”
That’s not a hypothetical concern; SIM-swap attacks have run rampant over
the past several years, and a previous breach, which T-Mobile disclosed in
February, was used specifically to execute them.
T-Mobile confirmed on Monday that a breach had occurred but not whether
customer data had been compromised. “We have been working around the clock
to investigate claims being made that T-Mobile data may have been
illegally accessed,” the company said in an emailed statement. “We have
determined that unauthorized access to some T-Mobile data occurred,
however we have not yet determined that there is any personal customer
data involved. We are confident that the entry point used to gain access
has been closed, and we are continuing our deep technical review of the
situation across our systems to identify the nature of any data that was
illegally accessed.”
FEATURED VIDEO
How to Protect Yourself After a Massive Corporate Hack
Get WIRED + a free tote
SUBSCRIBE NOW
Most Popular
ryan reynolds
CULTURE
Ryan Reynolds Called In a Favor for That Big Free Guy Cameo
ANGELA WATERCUTTER
primal filter + mask
GEAR
18 Face Masks We Actually Like to Wear
ADRIENNE SO
bacteria
CULTURE
Time Travelers Should Be a Lot More Worried About Viruses
GEEK'S GUIDE TO THE GALAXY
Sunisa Lee
SCIENCE
Gymnasts Make the Wolf Turn Look Easy. Physics Shows It’s Not
RHETT ALLAIN
In the meantime, you have a few admittedly limited steps you can take to
protect yourself, or at least limit the potential fallout if all that data
did get stolen. Change your T-Mobile password and security PIN. Companies
that have leaked social security numbers and other especially sensitive
information have in the past offered free credit monitoring to victims, so
keep an eye on communications from T-Mobile to see if it offers the same.
As for stopping SIM-swap attacks, there’s not much you can do against a
determined attacker, but a good first step is to start using app-based
authentication instead of having codes sent to you by text message.
After so many data breaches in recent years, it’s easy to let them drift
by without paying much mind. And it’s true, to a certain extent, that most
of the data you care about is available to hackers. “If I’m going to be
doing some identity theft, most of the information is already out there in
one of the dozens of other data breaches that have happened previously,”
Hassold says.
But it’s still important to focus on the big ones, both to know your
specific risks and to hold companies accountable for their lapses. So far,
shrugging it off hasn’t worked; if the data’s legitimate, this would be T-
Mobile’s sixth known breach in four years.
--
"LOCKDOWN", left-wing COVID fearmongering. 95% of COVID infections
recover with no after effects.
No collusion - Special Counsel Robert Swan Mueller III, March 2019.
Officially made Nancy Pelosi a two-time impeachment loser.
Donald J. Trump, cheated out of a second term by fraudulent "mail-in"
ballots. Report voter fraud: sf.n...@mail.house.gov
Thank you for cleaning up the disaster of the 2008-2017 Obama / Biden
fiasco, President Trump.
Under Barack Obama's leadership, the United States of America became the
The World According To Garp. Obama sold out heterosexuals for Hollywood
queer liberal democrat donors.
President Trump boosted the economy, reduced illegal invasions, appointed
dozens of judges and three SCOTUS justices.
sms
Aug 17, 2021, 12:09:53 PM8/17/21
to
On 8/16/2021 9:31 PM, Leroy N. Soetoro wrote:
<snip>
> But it’s still important to focus on the big ones, both to know your
> specific risks and to hold companies accountable for their lapses. So far,
> shrugging it off hasn’t worked; if the data’s legitimate, this would be T-
> Mobile’s sixth known breach in four years.
They obviously need to make some changes in their IT department.
<snip>
> But it’s still important to focus on the big ones, both to know your
> specific risks and to hold companies accountable for their lapses. So far,
> shrugging it off hasn’t worked; if the data’s legitimate, this would be T-
> Mobile’s sixth known breach in four years.
The Real Bev
Aug 18, 2021, 2:07:06 PM8/18/21
to
--
Cheers, Bev
Todd Flanders' hobbies include being quiet on long rides,
clapping to songs and diabetes.
0 new messages