Hacker takes credit for 54 million T-Mobile data breach, calls security ‘awful’

Hacker takes credit for 54 million T-Mobile data breach, calls security 'atrocious'

The headquarters of T-Mobile USA in Bellevue, Washington.

(Image credit: VDB Photos/Shutterstock)

A hacker who claims to exist backside last week's T-Mobile information breach that compromised 54 million people'south personal data told The Wall Street Journal in a story published today (Aug. 26) that the company's "security is awful."

John Binns, a 21-year-old American living in Turkey, his mother's homeland, told the paper that he found an unprotected T-Mobile router online in July, then used that to pivot on Aug. iv into more than 100 servers containing personal information of current and former customers at a T-Mobile data centre in central Washington country.

T-Mobile breach fallout — it's time to determine who deserves your concern
The best identity theft protection services
Plus: How to create a 'kill switch' in Windows

"I was panicking because I had access to something big," Binns told the Journal in a conversation on the Telegram encrypted-messaging platform.

The Periodical said it verified Binns' identity with a serial of personal questions, and said the Telegram business relationship he used had provided details of the T-Mobile hack before they became publicly known.

Binns would not tell the Journal whether he had sold whatsoever of the data he stole, or if he was paid to attack T-Mobile.

This is T-Mobile's fifth or 6th data breach in the past three years, depending who's counting. With such a dismal track tape, you might consider taking your business elsewhere if y'all value your private data.

At to the lowest degree 54 million people affected

The breach came to light Aug. 15 after a hacker offered to sell role of the data, pertaining to 30 million T-Mobile customers, for 6 bitcoin (almost $280,000) in a cybercriminal forum. The Journal implied that the seller may not have been Binns.

More than 54 million current, former and fifty-fifty prospective T-Mobile customers were affected, near of whom had their full names, dates of birth, Social Security numbers and electric current or former addresses compromised.

Those four bits of personal information are often all that's required to open an account in someone else'southward name, and the affected individuals are at serious risk of identity theft.

'Generating racket'

Binns told the Periodical that he attacked T-Mobile with the purpose of "generating noise," just added that he had been persecuted by U.South. authorities agents while he was in Germany. Binns sued the CIA, the FBI and other federal agencies last year, the Journal said, and the example is still active.

When the information breach was initially revealed, the credible hacker or hackers told an Israeli security researcher that the attack "was done to retaliate confronting the US for the kidnapping and torture of John Erin Binns (CIA Raven-one) in Deutschland by CIA and Turkish intelligence agents in 2019," according to Bleeping Computer.

The Journal said Binns appeared to be one of many people involved in the Mirai botnet set on that knocked out internet access for well-nigh of the U.S. Due east Coast on Oct. 21, 2016.

T-Mobile is offering anyone affected by the breach 2 years of costless identity-theft protection and credit monitoring. We recommend that whatever who'south ever practical for a T-Mobile account take the company up on the offer, and besides freeze their credit files if possible.

Paul Wagenseil is a senior editor at Tom'due south Guide focused on security and privacy. He has also been a dishwasher, fry cook, long-booty commuter, code monkey and video editor. He's been rooting around in the data-security infinite for more than 15 years at FoxNews.com, SecurityNewsDaily, TechNewsDaily and Tom'due south Guide, has presented talks at the ShmooCon, DerbyCon and BSides Las Vegas hacker conferences, shown up in random Television set news spots and even moderated a panel discussion at the CEDIA domicile-applied science conference. Yous can follow his rants on Twitter at @snd_wagenseil.