Hackers have found their way again into T-Mobile’s systems, the fourth reported breach of the company’s data since early 2020. This time, the haul included sensitive personal information associated with about 48 million people, most of whom were former or prospective customers of the self-styled “un-carrier.”
Here is a breakdown of what happened, the risks you might face and how you can protect yourself against them.
According to the company, the stolen data included names, birth dates, Social Security numbers and driver’s license information. In most cases, the company said, “no phone numbers, account numbers, [personal identification numbers], passwords, or financial information were compromised.” However, some 850,000 customers with prepaid accounts had their names, phone numbers and account PINs exposed, T-Mobile revealed.
Hackers started offering the data for sale last weekend, according to security researcher Brian Krebs, who predicted that it would all wind up online soon.
Although the potential number of people affected is huge, by T-Mobile’s count it represents less than half the company’s current 105 million customers. T-Mobile has said it will notify the customers whose data was exposed and provide two years of identity theft protection service for free from the security company McAfee.
Hackers steal even more Social Security numbers. How should you protect yourself?
Hackers claim to have stolen 70 million Social Security numbers from AT&T days after massive T-Mobile breach. Here are some tips to protect yourself.
There have been so many data breaches at so many companies over the years, some security experts say that much of the information exposed by T-Mobile is probably already available on the dark web. But that doesn’t mean you should just shrug off what happened. Those whose data were exposed face greater risks of identity theft, phishing scams and other forms of fraud, Krebs warned.
Social Security numbers are widely used by the federal government, banks, investment companies, government benefit programs and insurers to verify identity. Your stolen SSN can be used to open fraudulent credit card accounts, divert or fraudulently collect benefits and commit workplace fraud, among other forms of deceit. Throw in your name, birth date and driver’s license number, and it’s exponentially easier for someone to pretend to be you.
Identity thieves could use that information to target both you and the banks, insurers and other companies you do business with. For example, they could use it to make phishing emails seem more realistic, helping to persuade you to give up additional sensitive information such as a password or PIN. Or they could use it to dupe your bank into letting them change the password on your account, giving them access to your money.
For those whose phone numbers were also exposed, there’s at least one more malign possibility: a SIM-swap attack. That’s where someone persuades your mobile phone company to transfer your number to a different device, which he or she then uses to try to break into the accounts that you’ve tied to your phone number. It’s increasingly common for people to use their mobile numbers as a way to verify their identity — for example, when they log into their online banking account, or when they want to reset their password. But that convenience can backfire if your number is hijacked, then used to impersonate you online.
Op-Ed: As a doctor in a COVID unit, I’m running out of compassion for the unvaccinated. Get the shot
A doctor featured in a Times article published Sunday on the latest wave of COVID-19 speaks for herself in a searing letter to unvaccinated people.
The single best thing to do is to put a freeze on your credit files, which will prevent anyone from opening a new account. It’s free to place a freeze and to lift it for your own needs. But you have to contact each of the three major credit bureaus individually, which you can do online. Krebs also suggests freezing the credit files maintained by a handful of smaller, specialized agencies. You should also check your credit score regularly, which is a good way to detect fraud after it happens.
Credit- and identity-monitoring services, which typically carry a monthly fee, can also help reveal the work of identity thieves. They provide tools to prevent you from phishing and other forms of hacking combined with scanning services that look for your Social Security number or email address in places online where it doesn’t belong.
Meanwhile, T-Mobile has set up a website suggesting more steps people can take to guard against fraud. Anyone with a smartphone would be wise to take them:
On the plus side, two-factor authentication is becoming the standard online, and that’s improving security across the web. But too many sites encourage you make that second factor a text to your phone number, which encourages SIM swap fraud. Wherever possible, use an authentication app instead.
Column: COVID isn’t spread by mosquitoes. But the next pandemic might be
As an aggressive mosquito spreads in California, scientists say we got very lucky that the insects couldn’t transmit COVID-19 to people.
Jon Healey is a senior editor on the Utility Journalism team, which tries to help readers solve problems, answer questions and make big decisions about life in and around Los Angeles. He has been with the Los Angeles Times since 2000, previously reporting on technology news and writing opinion pieces.
More From the Los Angeles Times
Stocks end higher on Wall Street, breaking three-day slump
Subscribe for unlimited access