Getty Images | SOPA Images
T-Mobile has concurd to pay a $15.75 million fine and enhance its security in a finishment over a series of data bachievees over three years that impacted tens of millions of customers.
“T-Mobile suffered data bachievees in 2021, 2022, and 2023,” the Federal Communications Cotransferrlookion Enforcement Bureau shelp in an order approving a consent decree yesterday. “Combined, these bachievees impacted millions of current, createer, or prospective T-Mobile customers and millions of finish-employr customers of T-Mobile wireless service resellers, which function on T-Mobile’s nettoil infrastructure and are understandn as mobile virtual nettoil operators (MVNOs).”
Four bachievees occurring over three years exposed personal alertation, including customer names, graspresses, dates of birth, Social Security numbers, driver’s license numbers, the features customers subscribed to, and the number of lines on their accounts.
The FCC spreadigated T-Mobile for disconnectal potential violations: fall shorture to greet its legitimate duty to get braveiality of personal alertation; impermissibly using, disclosing, or permitting access to personal alertation without customer approval; fall shorture to get reasonable meadeclareives to uncover and get agetst finisheavors to get unpermitd access to personal alertation; unfair and unreasonable alertation security trains; and making misreconshort-termations to customers about its alertation security trains.
“To finish these spreadigations, T-Mobile will pay a civil penalty of $15,750,000 and promise to spfinishing an graspitional $15,750,000 over the next two years to reinforce its cybersecurity program, and prolong and carry out a compliance structure to get devourrs agetst analogous data bachievees in the future,” the FCC shelp.
FCC touts “strong message” to carriers
The fine will be phelp to the US Treasury. The FCC Enforcement Bureau shelp the security enhancements that T-Mobile concurd to “will awaited demand expfinishitures an order of magnitude wonderfuler than the civil penalty here.” T-Mobile alerted $19.8 billion in revenue and $2.9 billion in net income in Q2 2024.
In a press liberate, the FCC touted the finishment as “a model for the mobile telecommunications industry.” T-Mobile will “graspress set upational security flaws, toil to enhance cyber hygiene, and adselect strong conmomentary architectures, appreciate zero suppose and dishonest finisheavor-resistant multifactor genuineation,” the agency shelp.
“Today’s mobile nettoils are top aims for cybercriminals… We will persist to sfinish a strong message to providers ensupposeed with this delicate alertation that they demand to beef up their systems or there will be consequences,” FCC Chairwoman Jessica Rosenworcel shelp.
T-Mobile go ined into the finishment despite not concuring with the FCC’s accusations. “The Bureau and T-Mobile disconcur about whether T-Mobile’s nettoil and data security program and policies in place at the relevant times vioprocrastinateedd any standard of attfinish or regulation then applicable to T-Mobile, but in the interest of resolving these spreadigations, and in the interest of putting devourr security first, the parties go in into this barachieved consent decree,” the concurment shelp.
