US state sues T-Mobile over 2021 data breach which leaked data of millions

Image Credit: Shutterstock (Image credit: Shutterstock)

A 2021 T-Mobile data leak exposed millions of customer's data
Washington State is now suing the telecoms giant
The suit alleges that T-Mobile failed to protect and notify customers

The US state of Washington is taking legal action against telecommunications giant T-Mobile over consumer protections failures following a 2021 data breach which exposed up to 79 million consumers worldwide, including the social security numbers of almost 184,000 customers in the state.

As part of Washington’s lawsuit, the state claims T-Mobile failed to ‘adequately secure sensitive personal information of more than 2 million Washingtonians’. This failure, the state claims, left those consumers vulnerable to fraud and identity theft.

The suit claims that the breach was ‘entirely avoidable’ and explains T-Mobile had years to fix key vulnerabilities in its cybersecurity systems, and failed to properly address them. A lack of security monitoring meant T-Mobile was unaware of the breach.

T-Mobile customers mislead

The suit alleges T-Mobile deliberately downplayed the severity of the breach to affected consumers, and omitted critical information, which in turn affected customer’s ability to ‘adequately assess their risk of identity theft or fraud’.

The firm sent out texts to affected customers, but failed to include legally required information. Customers who didn’t have their card details or social security numbers compromised were informed of such, but those who did, weren’t given any information about the exposure.

According to the suit, T-Mobile used ‘weak credentials’ and an ‘easily guessable username and password’, and the exposed data appeared for sale on the dark web almost immediately after it was stolen.

T-Mobile has recently agreed to pay an over $15 million penalty to the FCC as part of a settlement deal following a string of high-profile data breaches between 2021 and 2023. The company was also ordered to make significant changes to its cybersecurity infrastructure, and adopt more robust identity and access management frameworks.

Check out our list of the best firewall software around today
We've also rounded up the best antivirus on offer right now
The true cost of a security breach

Ellen has been writing for almost four years, with a focus on post-COVID policy whilst studying for BA Politics and International Relations at the University of Cardiff, followed by an MA in Political Communication. Before joining TechRadar Pro as a Junior Writer, she worked for Future Publishing’s MVC content team, working with merchants and retailers to upload content.