T-Mobile US Inc. suffered a cyberattack that exposed some personal information belonging to 37 million customers, but not “the most sensitive” kinds, the wireless giant said Thursday.
The attack occurred through a breach of an application programming interface that T-Mobile
TMUS,
discovered Jan. 5, according to a Thursday filing with the Securities and Exchange Commission. The API provided access to “a limited set” of account data including names, billing addresses, email addresses, phone numbers, birthdays and account numbers, as well as some information about the types of plans customers are on.
“Our systems and policies prevented the most sensitive types of customer information from being accessed, and as a result, based on our investigation to date, customer accounts and finances were not put at risk directly by this event,” T-Mobile said in the filing. The company also noted that it doesn’t have any evidence of a breach of its systems or network.
Though the company identified 37 million current postpaid and prepaid customer accounts whose data were accessed, it noted that “many of these accounts did not include the full data set.”
After discovering the malicious activity, T-Mobile said it was able to stop it within a day. Its ongoing investigation indicates that the issue is fully contained but that the bad actor appeared to start gaining access on or near Nov. 25, 2022.
“We may incur significant expenses in connection with this incident,” T-Mobile disclosed.
The company is “unable to predict the full impact of this incident on customer behavior in the future, including whether a change in our customers’ behavior could negatively impact our results of operations on an ongoing basis,” but doesn’t currently foresee a material impact.
T-Mobile is working with law enforcement in the aftermath of the incident and has started to inform customers about it.
The company suffered a hack impacting more than 54 million current, former and prospective customers back in 2021, and it agreed to a $350 million settlement for that incident last summer.
The announcement comes amid strong relative performance for T-Mobile’s stock, which has risen 38% over the past 12 months, as shares of Verizon Communications Inc.
VZ,
have fallen 25% and as shares of AT&T Inc.
T,
have lost 8% over that time.