t-mobile ceo tim holtz says he is 'truly sorry' for the breach that exposed 50million users' data a day after the hacker claimed
T-Mobile's top executive is apologizing for a malicious cyberattack that exposed 50 million users' data to hackers.
‘Attacks like this are on the rise and bad actors work day-in and day-out to find new avenues to attack our systems and exploit them,’ chief executive Mike Sievert said in a statement released Friday. ‘We spend lots of time and effort to try to stay a step ahead of them, but we didn’t live up to the expectations we have for ourselves to protect our customers. Knowing that we failed to prevent this exposure is one of the hardest parts of this event.
‘On behalf of everyone at Team Magenta, I want to say we are truly sorry.’
The names, social security numbers, and other personal data of nearly 50 million current, former, and prospective T-Mobile customers were stolen during a data breach earlier this month.
When confirming the security violation August 17, T-Mobile said it had closed the ‘entry point’ used to gain access to its system, and that it was investigating ‘with the highest degree of urgency.’
T-Mobile chief executive Mike Sievert says he's 'truly sorry' for a cyberattack that exposed the personal data of about 50 million people
A 21-year-old hacker has taken credit for the breach, saying it was surprisingly easy to swipe data from its servers
With the ‘malicious cyberattack’ now contained and T-Mobile’s internal investigation complete, Sievert said the communications giant is now working to prevent future incidents from happening.
A 21-year-old American hacker living in Turkey has claimed responsibility for the data theft, and told The Wall Street Journal that he used an unprotected router to access the personal records of T-Mobile customers.
'I was panicking because I had access to something big,' John Binns told the newspaper. 'Their security is awful.'
Binns, who provided screenshots and evidence to back up his claim, said that the entry point allowed him to hack into the company's data center in Washington state, where stored credentials allowed him to access more than 100 servers.
Breaking into T-Mobile’s systems was surprisingly easy, Binns said.
He found the unprotected router by scanning T-Mobile's known internet addresses for weak spots using a simple tool available to the public, he told the Journal.
Once inside, he said it took about a week to access the servers that contained personal data about the carrier's millions of current and former customers.
The breach first came to light when hackers began offering customer data for sale on the dark web. Binns declined to say whether he had sold any of the stolen data.
The man who leads the technological behemoth did not directly reference the self-confessed hacker in his latest statement.
But Sievert did say that ‘in short, this individual’s intent was to break in and steal data, and they succeeded.’
About 7.8 million current customers and 40 million former or prospective customers who applied for credit with the carrier had their sensitive information stolen, T-Mobile said.
The names, phone numbers, and account PINS of an additional 850,000 active prepaid customers was also swiped.
Some T-Mobile customers have sued the company for damages in Seattle federal court
The company is offering two years of identity protection services with McAfee's ID Theft Protection Service and has recommended eligible T-Mobile customers sign up for 'scam-blocking protection' through Scam Shield.
Some T-Mobile customers sued the company for damages last Thursday night in Seattle federal court, saying in a proposed class action that the cyberattack violated their privacy and exposed them to a higher risk of fraud and identity theft.
The Seattle field office of the FBI is investigating the breach.
Sievert also announced Friday that T-Mobile has entered into long-term partnerships with Mandiant’s cybersecurity experts, as well as consulting firm KMPG LLP.
‘We know we need additional expertise to take our cybersecurity efforts to the next level—and we’ve brought in the help,’ he said in the statement. ‘These arrangements are part of a substantial multi-year investment to adopt best-in-class practices and transform our approach. This is all about assembling the firepower we need to improve our ability to fight back against criminals and building a future-forward strategy to protect T-Mobile and our customers.’