T-Mobile CEO: Hackers brute-forced their way through our network

Today, T-Mobile's CEO Mike Sievert said that the hackers behind the carrier's latest massive data breach were able to brute force their way through T-Mobile's network after gaining access to testing environments.

The attacker could not exfiltrate customer financial information, credit card information, debit or other payment information during the incident.

However, T-Mobile says that he stole records belonging to 54.6 million current, former, or prospective customers, containing SSNs, names, addresses, dates of birth, and driver license/ID information.

"No ongoing risk to customer data"

"While we are actively coordinating with law enforcement on a criminal investigation, we are unable to disclose too many details," Sievert said in a  statement published earlier today.

"What we can share is that, in simplest terms, the bad actor leveraged their knowledge of technical systems, along with specialized tools and capabilities, to gain access to our testing environments and then used brute force attacks and other methods to make their way into other IT servers that included customer data."

Sievert added that, following an investigation supported by Mandiant security experts, the company closed the access points used by the hacker to breach T-Mobile's network.

"We are confident that there is no ongoing risk to customer data from this breach," the US mobile carrier's CEO added.

"There is much work to do, and this will take time, and we remain committed to doing our best to ensure those who had information exposed feel informed, supported, and protected by T-Mobile."

This is the sixth major data breach T-Mobile publicly acknowledged in the past four years:

In 2018, info belonging to millions of T-Mobile customers was accessed by hackers. In 2019, T-Mobile exposed prepaid customers' data. In March 2020, hackers gained access to T-Mobile employees' email accounts. In December 2020, hackers accessed exposed customer proprietary network information (phone numbers, call records). In February 2021, threat actors targeted up to 400 customers in SIM swap attacks after gaining access to an internal T-Mobile application.

Hacker makes fun of T-Mobile's 'awful' security

John Erin Binns, a 21-year-old American now living in Turkey, claims to be the one behind this massive breach according to a Wall Street Journal report from Thursday.

After hacking into their Washington state data center, he purportedly gained access to credentials for more than 100 servers on T-Mobile's network.

According to Binns' claims, the initial attack vector used to breach the T-Mobile network was an Internet-exposed and unprotected router.

"Their security is awful," the alleged attacker said. "I was panicking because I had access to something big."

In his Telegram chat with the WSJ, Binns avoided confirming if he was paid to hack into T-Mobile's systems or if he sold any of the stolen data to others.

As BleepingComputer reported almost two weeks ago, a threat actor was selling what he claimed to be a database containing the personal info of roughly 100 million T-Mobile customers on a hacking forum.

He also said the attack's goal was to "retaliate against the US for the kidnapping and torture of John Erin Binns (CIA Raven-1) in Germany by CIA and Turkish intelligence agents in 2019."

Binns sued the FBI, CIA, and Department of Justice in 2020 for being tortured and harassed. He is trying to force the USA to release documents exposing these activities under the Freedom of Information Act.

Any threat actors who got their hands on the information of T-Mobile customers stolen in this incident can use it in highly dangerous SIM swapping attacks that could allow them to take over victims' online accounts and steal their identity.

All potentially affected customers should be on the lookout for suspicious emails or text messages pretending to come from T-Mobile and not click on any embedded links if they spot one to prevent having their credentials stolen.

A T-Mobile spokesperson was not available for comment when contacted by BleepingComputer earlier today to confirm Binns's claims.