Some T-Mobile customers logged into their accounts on Wednesday to find another customer's billing and account information showing on their online dashboards.
T-Mobile denied there was an attack, but confirmed there had been a data leak. It said a “temporary system glitch” had misplaced some subscriber account information, causing it to appear on other subscribers' profile pages.
> "There was no cyberattack or breach at T-Mobile. This was a temporary system glitch related to a planned overnight technology update involving limited account information for fewer than 100 customers, which was quickly resolved."
Given the great number and the nature of the complaints on social media, one might suspect that T-Mobile is underplaying or underestimating the situation. Some users said they could access the information of several other subscribers and that they had complained about the issue before.
Multiple users who reported the issue online said they were seeing the same alternate account as others. These T-Mobile app users discovered that thei Bill tab was displaying someone else’s account information, and allowed users to view and access the bill pages and profile settings of other customers.
To worsen the problem, some users started changing the information they saw, believing they were correcting errors in their own details. Many payments were made on these accounts as well. This was likely also done by users unaware of the fact they were accessing someone else's account.
The exposed information included customers’ names, phone numbers, addresses, account balances, and the expiration dates and last four digits of credit cards.
Victims should monitor their credit reports and be on alert for scammers using leaked information to trick them into giving up additional information, like bank account credentials.
Credit card companies have sophisticated fraud detection and alert systems. One way to be alerted to possible fraudulent activity on your account is to opt in to text message, call or email alerts. When you discover a fraudulent charge, call your credit card issuer right away to report the unauthorized charge. In most cases, if you report suspected fraud right away, you will not be liable for any unwanted charge, no matter the amount.
We will keep you posted here if more information about the issue becomes available. So, stay tuned!
There are some actions you can take if you are, or suspect you may have been, the victim of a data breach.
Don’t become a victim of identity fraud. Keep your identity, finances, and devices safe by using Cyrus.