State of Washington files lawsuit against T-Mobile for massive data breach

The state of Washington has filed a lawsuit against telecommunications carrier T-Mobile for failing to adequately secure sensitive and personal information of millions of consumers.

In August 2021, T-Mobile discovered that a hacker had gained access to the company’s corporate network. He was able to collect personal information of roughly 79 million customers, including full names, phone numbers, physical addresses, driver’s license information, IMEI and IMSI numbers. The data was then sold on a hacking forum on the dark web.

According to Bob Furgeson, Attorney General in the state of Washington, T-Mobile failed to properly secure the personal information of approximately 2 million Washingtonians. This resulted in a massive data breach and made consumers vulnerable to financial fraud and identity theft.

“This significant data breach was entirely avoidable. T-Mobile had years to fix key vulnerabilities in its cybersecurity systems, and it failed,” Furgeson said in a statement.

According to the lawsuit, the threat actor exploited T-Mobile’s inadequate cybersecurity risk management, inadequate network configuration management, inadequate identification and authentication management, inadequate asset management, and inadequate security monitoring and alerting management.

“T-Mobile’s failure to remediate its cybersecurity vulnerabilities went against its internal policies and procedures, as well as known industry standards. T-Mobile’s business practices led directly to the exposure and exfiltration of PII [personally identifiable information, ed.] in the August Breach,” the indictment states.

In addition, Furgeson blames T-Mobile for not properly informing all affected customers. Furthermore, the company left out important details and downplayed the risks of financial fraud and identity theft when informing victims.

Furgeson is seeking civil penalties and restitution for all Washingtonians that were harmed due to the data breach. He also seeks injunctive relief to require improvements to T-Mobile’s cybersecurity policies and procedures, as well as increased transparency in communications about cybersecurity to its customers.

In 2022, T-Mobile agreed to settle a class action lawsuit brought by customers over the data breach for $350 million. In addition, the telecommunications carrier invested $150 million to bump up security.