The T-Mobile Breach Is Much Worse Than It Had to Be

In an email overnight, T-Mobile shared details about the data breach it confirmed Monday afternoon. They’re not great. Assorted data from more than 48 million people was compromised, and while that’s less than the 100 million that the hacker had initially advertised, the vast majority of those affected turn out not to be current T-Mobile customers at all.

Instead, T-Mobile says that of the people whose data was compromised, more than 40 million are former or prospective customers who had applied for credit with the carrier. Another 7.8 million are current “postpaid” customers, which just means T-Mobile customers who get billed at the end of each month. Those roughly 48 million users had their full names, dates of birth, social security numbers, and driver’s license information stolen. An additional 850,000 prepaid customers—who fund their accounts in advance—had their names, phone numbers, and PINs exposed. The investigation is ongoing, which means that the tally may not stop there.

There’s no good news here, but the slightly less bad news is that the vast majority of customers appear not to have had their phone numbers, account numbers, PINs, passwords, or financial information taken in the breach. The bigger question, though, is whether T-Mobile really needed to hold on to such sensitive information from 40 million people with whom it doesn’t currently do businesses. Or if the company was going to stockpile that data, why it didn’t take better precautions to protect it.