HackingTelecom & MediaInformationStolen CredentialsSupply Chain (3P Vendor)Data ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDMediumContained

T-MOBILE USA, INC.

bd_19093bdb9a9ec6d4 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 15, 2015

Filed

Oct 1, 2015

To disclose

16 days

Affected

Not disclosed

Linked

4 filings

Confidence

66%

Full breach record for T-MOBILE USA, INC. →22 incidents on file

T-Mobile USA, Inc. disclosed that an unauthorized party accessed Experian servers housing T-Mobile data on September 15, 2015. The breach, occurring around September 14, 2015, involved the exfiltration of personal information including names, addresses, Social Security numbers, dates of birth, and government ID numbers. No payment card or banking information was compromised. T-Mobile and Experian notified law enforcement and offered two years of credit monitoring to affected individuals.

J jump to incidentP pin to compareR raw source

California clockDiscovered Sep 15, 2015 → Notified Oct 2, 201517d ✓ CA 60-day OK16 days discovery → filing

Incident timeline

undetected · 1 days

discovery → filing · 16 days

Sep 14, 2015

Begins

Sep 15, 2015

Discovered

Oct 1, 2015

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_16201a335c3674ae2015-10-01Verified
Montana State AGbd_ba0dd1171b8616bb2015-10-01Candidate
Massachusetts State AGbd_8f10059d4aee79f82015-11-04 · +34dCandidate

Name: T-MOBILE USA, INC.
norm: t mobile usa
Domain: t-mobile.com

Name: T-MOBILE USA, INC.
norm: t mobile usa
Domain: t-mobile.com
Industry: Telecom & Mediallm

Discovered: Sep 15, 2015
Breach occurred: Sep 14, 2015
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Oct 2, 2015
Affected individuals: Not disclosed
Data types: Identity (basic)Government ID
Data elements: Date of birth
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1195 Supply Chain CompromiseT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: Notified appropriate federal, state and international law enforcement agencies
Third party: via Experian
Initial access: supply_chain

During the incident: Immediately began to investigate the incident
Implemented additional security measures
Notified T-Mobile USA, Inc. that information had been downloaded
Notified appropriate federal, state and international law enforcement agencies
Offering a complimentary two-year membership in ProtectMyID Elite credit monitoring and identity theft resolution services
Changes made: Taken additional security steps to help prevent future incidents
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 days(16 days from discovery to filing)
Compliance flags: CA 60-day OK · 17d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Sep 15, 2015
→ Notified: Oct 2, 2015
17d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Sep 15, 2015 → Notified: Oct 2, 2015	17d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

Massachusetts State AGOct 1 · first

Montana State AGOct 1 · first

California State AGOct 1 · first · this page

Massachusetts State AG+34d

Pattern: first filing Oct 1 (MA), last Nov 4 (MA) — a 34-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-58079
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 1, 2015
Raw hash: 4163053e3df6857c0c79ebdaf394ea138c197617bc0fbaf4fdee17b5ed76cfd3

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityT-MOBILE USA, INC.

Victim entityT-MOBILE USA, INC.

Incidentdiscovered Sep 15, 2015

Stated responseImmediately began to investigate the incident

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov