T-Mobile is investigating a data breach, a spokesperson said Monday.
While the company said it wasn’t yet sure whether the breach involved customer data, the announcement came on the heels of unverified claims by an anonymous hacker on social media that he had an enormous cache of stolen sensitive customer data.
“We have determined that unauthorized access to some T-Mobile data occurred, however we have not yet determined that there is any personal customer data involved,” the company said in a statement emailed Monday afternoon.
“We have been working around the clock to investigate claims being made that T-Mobile data may have been illegally accessed,” the statement said.
Early Sunday, before allegations of a new T-Mobile breach were public, a self-proclaimed hacker said on social media and in a hacker forum that he had sensitive stolen information from 100 million customers, including driver’s license and Social Security numbers, and that the information for more than 30 million customers had never before been published. The claims were first reported by Motherboard.
While it’s common for self-proclaimed hackers to exaggerate or fabricate claims, a T-Mobile spokesperson made it clear Sunday evening that the company was taking them seriously. It was “aware of claims” and “actively investigating” them, the spokesperson said.
T-Mobile, which merged with Sprint last year to become the second most widely used telecommunications company in the U.S., has struggled to keep data secure. It has suffered at least one publicly known data breach a year since 2018, as well as an additional one in January.
The 2018 and 2020 breaches revealed customers’ personal data, but neither included particularly sensitive information like Social Security numbers, and each was believed to affect only several million people.
Contacted on the messaging app Telegram on Monday, the hacker claimed to have hacked T-Mobile with some associates.
In its statement, T-Mobile declined to address the number of potential victims until it had finished investigating.
“This investigation will take some time but we are working with the highest degree of urgency,” it said. “Until we have completed this assessment we cannot confirm the reported number of records affected or the validity of statements made by others.”
