4 data breaches costed T-Mobile 31.5 million dollars

The FCC's Privacy and Data Protection Task Force, established in 2023 by Chairwoman Rosenworcel has played a central role in the investigation and settlement, just as it did when the FCC reached similar settlements with AT&T in September 2024 ($13 million) and Verizon on behalf of its subsidiary TracFone Wireless in July 2024 ($16 million).

The Federal Communications Commission (FCC) has announced a $31.5 million settlement with T-Mobile over multiple data breaches that compromised the personal information of millions of U.S. consumers. As part of the settlement, the telecom carrier must invest $15.75 million in cybersecurity enhancements and pay the U.S. Treasury an additional $15.75 million civil penalty.

The FCC shared that T-Mobile with 119.7 million customers, will address "foundational security flaws, work to improve cyber hygiene, and adopt robust modern architectures, like zero trust and phishing-resistant multi-factor authentication.

"Today’s mobile networks are top targets for cybercriminals. We will continue to send a strong message to providers entrusted with this delicate information that they need to beef up their systems or there will be consequences," elaborated Jessica Rosenworcel, Chairwoman, FCC.

This agreement resolves the FCC Enforcement Bureau investigations into several cybersecurity incidents and resulting data breaches that impacted T-Mobile's customers in 2021, 2022, and 2023 (an API incident and a sales application breach).

The company has also committed to implementing more robust security measures, including adopting modern cybersecurity frameworks like zero-trust architecture and multi-factor authentication that resists phishing attacks. T-Mobile has also assued to enhance privacy, data security, and cybersecurity practices by addressing foundational security flaws, improving cyber hygiene, and adopting robust modern architectures.