News and Events 
So far in 2024, many major companies have fallen victim to credential stuffing attacks. Some of these notable credential stuffing victims include Roku, Okta, General Motors
One week after T-Mobile initially disclosed that it had been victimized by a data breach, the news just keeps getting worse for the telecom giant. What the company originally thought was a breach impacting just under 50 million consumers has now grown to over 53 million — and, as T-Mobile stresses on its website, it is still investigating and “will continue for some time.”
This is at least the fifth breach T-Mobile has suffered in the past four years. As of this writing, how attackers managed to access T-Mobile’s systems isn’t yet known. Here’s what we do know:
- The impacted consumers include about 13.1 million current T-Mobile postpaid customers and over 40 million former or prospective customers.
- Up to 52,000 names related to current Metro by T-Mobile accounts may also have been compromised.
- T-Mobile says it has located and closed the access point of the breach.
- T-Mobile has stressed that the compromised data doesn’t include any financial data, such as bank account numbers or payment card data.
- The compromised data does include names, addresses, birthdates, driver’s license information, and Social Security Numbers.
- In some cases, the compromised data also included phone numbers, IMEI and IMSI information (the identifier numbers associated with mobile phones), and account PINs. T-Mobile has proactively reset all compromised PINs.
Telecom companies are targeted by cybercriminals every day. Get protected from ransomware and other cyber threats with Keeper Enterprise.
The fact that the compromised data didn’t include financial information is of little comfort. With consumers’ Social Security Numbers, driver’s license information, and other Personal Identifying Information (PII) in hand, cybercriminals can potentially gain access to existing bank and credit card accounts, or even open up new ones.
T-Mobile has urged customers to change their T-Mobile account passwords and PINs. This is sound advice, but for full protection, consumers should change all of their account passwords. This attack is a reminder that consumers and businesses across the globe need to make password security a top priority. Cybercriminals, knowing that many people use weak passwords or reuse passwords across accounts, are undoubtedly already attempting to breach T-Mobile customers’ other accounts. Other proactive steps consumers should take include:
- Enable Multi-Factor Authentication (MFA) on all accounts that support it. This way, even if a cybercriminal gets hold of a working password, they’ll be unable to use it without the second authentication factor.
- Always use strong, unique passwords, and never reuse passwords across accounts.
- Start using a password manager such as Keeper. In addition to helping you change your account passwords, Keeper will automatically generate strong, unique passwords for all of your accounts, store them in a secure digital vault that you can access from any device, running any operating system, and automatically fill them across all of your sites and apps.
- Subscribe to a Dark Web monitoring service such as Keeper’s BreachWatch, which scans Dark Web forums and notifies you in real time if any of your passwords have been compromised. This enables you to reset compromised passwords right away, before cybercriminals have a chance to use them.
Not a Keeper customer yet? Sign up for a 14-day free trial now! Want to find out more about how Keeper can help your organization prevent security breaches? Reach out to our team today.
