Early-2023 T-Mobile Data Breach Sparks Class Action

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action alleges T-Mobile’s failure to properly secure customers’ personal information resulted in a roughly month-long data breach between February and March of this year.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

According to the 49-page case, an unknown third party was able to hack the company’s “inadequately maintained” network from February 24 to March 30, 2023, gaining access to sensitive data belonging to about 836 current and former T-Mobile users.

In an April 28 notice sent over a month after T-Mobile said it first detected the breach, the carrier informed affected individuals that the data potentially stolen in the incident included their full names, contact information, account numbers and associated phone numbers, account PINs, Social Security numbers, government IDs, dates of birth, balances due, internal codes that T-Mobile uses to service customer accounts and the number of phone lines tied to particular accounts.

The complaint claims that T-Mobile, which agreed to allocate at least $150 million toward improving cybersecurity as part of a $350 million class action settlement over a 2021 data breach, left customers’ information “accessible, unencrypted, unprotected, and vulnerable” despite “the known risk and foreseeable likelihood” of exfiltration by unauthorized individuals.

T-Mobile is facing similar litigation in the wake of a November 2022 data breach that reportedly affected 37 million customers.

Per the suit, T-Mobile’s failure to implement and maintain reasonable cybersecurity measures is out of line with industry standards and federal and state laws regarding data security.

“Plaintiff and Class Members now suffer from a present and continuing risk of harm, including fraud and identity theft, and must now constantly monitor their financial accounts,” the complaint says, stressing that the potential publication of their data on the dark web can be used to commit an array of crimes.

The plaintiff, a New Jersey doctor who used one of the five cell phone lines associated with his T-Mobile account to communicate with patients, says he has been forced to spend significant time, money and effort to resolve issues attributable to the data breach. 

For example, beginning on February 28, the plaintiff lost approximately $13,000 worth of cash and cryptocurrency after an unauthorized individual was able to make transfers out of his Coinbase account, the suit relays. The complaint says that unknown actors also used private data exposed in the breach to compromise the plaintiff’s Microsoft Hotmail account and make two attempts to add a prepaid phone line to his T-Mobile account.

By waiting until April 2023 to inform victims of the incident, T-Mobile denied the plaintiff and other affected individuals any opportunity to take timely action to protect themselves and mitigate harm, the case claims.

When T-Mobile finally announced the cyberattack, it “deliberately underplayed” the severity of the breach, omitting details about how the incident occurred, exactly what data belonging to each affected individual was compromised, the extent to which those data elements were compromised and who perpetrated the breach, the complaint charges.

The lawsuit seeks to represent anyone in the United States whose personally identifiable information or protected health information was impacted by the data breach referenced in the notice sent by T-Mobile in April 2023.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.