T-Mobile: Breach Exposed SSN/DOB of 40M+ People

#1

Post by todsacerdoti » Wed, Aug 18, 2021, 4:42 PM UTC

T-Mobile: Breach Exposed SSN/DOB of 40M+ People
krebsonsecurity.com

Re: T-Mobile: Breach Exposed SSN/DOB of 40M+ People

#2

Post by swiley » Wed, Aug 18, 2021, 4:48 PM UTC

Absolutely no one else should be able to run a carrier on those frequencies, these people are experts. That's why they let foreign companies run their infrastructure for them.

Re: T-Mobile: Breach Exposed SSN/DOB of 40M+ People

#3

Post by iamricks » Wed, Aug 18, 2021, 4:48 PM UTC

Are SSNs stored in plain text?

Re: T-Mobile: Breach Exposed SSN/DOB of 40M+ People

#4

Post by lotsofpulp » Wed, Aug 18, 2021, 4:49 PM UTC

Any entity using SSN and DOB as identity verification should be solely liable for any loss caused by fraud.

Re: T-Mobile: Breach Exposed SSN/DOB of 40M+ People

#5

Post by minikites » Wed, Aug 18, 2021, 4:50 PM UTC

Will T-Mobile or anyone in a leadership position there face consequences for this?

Re: T-Mobile: Breach Exposed SSN/DOB of 40M+ People

#6

Post by coldcode » Wed, Aug 18, 2021, 4:51 PM UTC

As usual they don't say how this was accomplished. They call it "sophisticated" but it probably was just stupid or lazy, which is very common in most corporate hacks. Big companies don't really care much about security since it costs money and rarely causes much trouble to your stock price and exec compensation.

The people who suffer are those whose data is compromised and have no idea it happened.

Re: T-Mobile: Breach Exposed SSN/DOB of 40M+ People

#7

Post by tyingq » Wed, Aug 18, 2021, 4:51 PM UTC

iamricks wrote: post #3

Are SSNs stored in plain text?

Probably so, in this case.

Here's a screenshot they uploaded as proof of the hack: https://pbs.twimg.com/media/E848JkGUUAIhIq5?format=jpg

You can see that it's running Goldengate, software used to replicate Oracle or other databases. So it probably had all the DB credentials needed to just export the whole database.

Re: T-Mobile: Breach Exposed SSN/DOB of 40M+ People

#8

Post by gjsman-1000 » Wed, Aug 18, 2021, 4:52 PM UTC

Well, at least it doesn't compromise the cheaper resellers (like Boost or Mint Mobile or Metro). Ironic that the cheap resellers are safer than the supposedly premium network.

Re: T-Mobile: Breach Exposed SSN/DOB of 40M+ People

#9

Post by criticaltinker » Wed, Aug 18, 2021, 4:52 PM UTC

Previous discussion from two days ago: https://news.ycombinator.com/item?id=28202399

This article does seem to report different numbers - 47M instead of 100M.

Re: T-Mobile: Breach Exposed SSN/DOB of 40M+ People

#10

Post by A4ET8a8uTh0 » Wed, Aug 18, 2021, 4:52 PM UTC

It is annoying. Between all the breaches, it is virtually guaranteed my information is floating out there. The worst part is, I have zero to no recourse here. What are they gonna offer me? Discounted credit monitoring?

What is the tipping point? Did we manage to pass it altogether ( asking since even I took this news as... eh, why bother )?

Honestly, what needs to happen to make it 'not so'.