T-Mobile reports data for about 37 million accounts obtained through an API

T-Mobile US disclosed on January 19, 2023 that a bad actor had been obtaining customer account data through a single application programming interface without authorization. The company identified the activity on January 5 and said it traced and stopped it within a day. Its estimate was data from approximately 37 million postpaid and prepaid accounts.

What T-Mobile reported

The scale was given as a preliminary figure.

The company said the API could return name, billing address, email, phone number, date of birth, account number and plan details, but not payment card data, Social Security or tax ID numbers, passwords or other government IDs. It dated the start of the data retrieval to around November 25, 2022. That means the activity ran for roughly six weeks before detection.

Materiality

T-Mobile said it might incur significant expenses but did not expect a material effect on operations. The filing does not explain how the API was reached.