T-Mobile has consented to pay a $15.75 million penalty and bolster its security measures as part of a settlement following a sequence of data breaches spanning three years that impacted millions of its customers.
“T-Mobile experienced data breaches in 2021, 2022, and 2023,” stated the Federal Communications Commission Enforcement Bureau in a decree issued yesterday. “These incidents collectively affected a vast number of current, former, or potential T-Mobile customers as well as millions of end-users of mobile virtual network operators (MVNOs) that utilize T-Mobile’s network infrastructure.”
Across these four breaches, exposed data included customer names, addresses, birth dates, Social Security numbers, driver’s license details, subscribed services, and the count of lines associated with their accounts.
The FCC’s investigation into T-Mobile revolved around multiple potential violations, including failing to safeguard the privacy of confidential information; improperly using, revealing, or allowing access to private information without customer consent; not taking adequate steps to detect and protect against unauthorized attempts to access private data; engaging in unfair and unreasonable information security practices; and providing misleading information to customers regarding its security measures.
To resolve these investigations, T-Mobile will not only pay a civil fine of $15,750,000 but will also allocate an additional $15,750,000 over the next two years to enhance its cybersecurity infrastructure and develop a compliance strategy to prevent future data breaches,” the FCC announced.
FCC Emphasizes “Strong Message” to Mobile Carriers
The penalty will be directed to the US Treasury. The FCC Enforcement Bureau noted that the security enhancements T-Mobile has agreed to implement “will likely cost significantly more than the penalty itself.” T-Mobile reported earnings of $19.8 billion in revenue and a net income of $2.9 billion in the second quarter of 2024.
The FCC highlighted the agreement as a “benchmark for the mobile telecommunications sector.” T-Mobile is set to “rectify fundamental security weaknesses, enhance cyber hygiene, and adopt advanced security frameworks such as zero trust and phishing-resistant multifactor authentication,” according to the agency.
“Today’s mobile networks are prime targets for cyberattacks… We will keep sending a clear message to providers responsible for safeguarding sensitive information that they must enhance their security systems, or face consequences,” stated FCC Chairwoman Jessica Rosenworcel.
Despite not agreeing with all of the FCC’s claims, T-Mobile decided to enter the settlement. “The Bureau and T-Mobile hold differing views on whether the network and data security strategies T-Mobile had in place at the time met applicable standards or regulations. However, both parties have agreed to this consent decree in order to focus on enhancing consumer security,” the agreement mentioned.
I am Sofia, a tech-savvy journalist and passionate member of the “Jason Deegan” team. Growing up, I was always fascinated by the latest technological advancements and loved sharing my knowledge with others.