HackingTechnologyTelecom & MediaInformationStolen CredentialsData ExfiltratedCustomer Data InvolvedIdentity (basic)Government IDPIICriticalActive

T-MOBILE USA, INC.

bd_4acd7ab8e9482cae · schema v1 · pii pii-v1

Severity

Critical

Discovered

Sep 15, 2015

Filed

Oct 1, 2015

To disclose

16 days

Affected

328,889state residents only

Linked

7 filings

Confidence

69%

Full breach record for T-MOBILE USA, INC. →22 incidents on file

Experian, a third-party vendor for T-Mobile USA, Inc., experienced unauthorized access to systems on September 15, 2015. The intruder accessed PII of approximately 328,889 Washington residents who applied for T-Mobile service, including names, SSNs, DOBs, and driver's license numbers. T-Mobile notified Experian on September 21, 2015. Law enforcement was notified, and credit monitoring services were offered to affected individuals.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 16 days

Sep 15, 2015

Begins

Sep 15, 2015

Discovered

Oct 1, 2015

Filed

vs. sector median

9 wks faster

This filing is one of 7 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_16201a335c3674ae2015-10-01Verified
California State AGbd_19093bdb9a9ec6d42015-10-01Verified
Indiana State AGbd_adff277577bf9c912015-10-01Verified
Montana State AGbd_ba0dd1171b8616bb2015-10-01Candidate

Show 2 more filings ↓up to 34d gap

Oregon State AGbd_9ec2e9674ac7b1422015-10-30 · +29dVerified
Massachusetts State AGbd_8f10059d4aee79f82015-11-04 · +34dCandidate

Name: T-MOBILE USA, INC.
norm: t mobile usa
Domain: t-mobile.com

Name: T-MOBILE USA, INC.
norm: t mobile usa
Domain: t-mobile.com
Industry: TechnologyllmTelecom & Mediallm

Discovered: Sep 15, 2015
Breach occurred: Sep 15, 2015
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 8, 2015
Affected individuals: 328,889state-resident count only
Data types: Identity (basic)Government IDPII
Data elements: Passport numberMilitary ID numberDate of birthDriver's licence numberSocial Security numberName
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: ExternalFinancial
Regulator citations: Notified Washington Attorney General's Office
Initial access: valid_credentials

During the incident: Experian has notified appropriate federal, state and international law enforcement agencies
Experian is mailing notification letters to affected individuals
Experian is notifying impacted individuals through a public website and notices in statewide media
Experian has taken additional security steps to help prevent future incidents
Changes made: Offering a complimentary two-year membership in ProtectMyID Elite credit monitoring and identity theft resolution services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 days(16 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 6 states

View merged incident ↗

Massachusetts State AGOct 1 · first

California State AGOct 1 · first

Indiana State AGOct 1 · first

Montana State AGOct 1 · first

Washington State AGOct 1 · first · this page

Oregon State AG+29d

Massachusetts State AG+34d

Pattern: first filing Oct 1 (MA), last Nov 4 (MA) — a 34-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9591.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 1, 2015
Raw hash: 0d0b2ab76efbf649845cfcdb4c22ccd8affce357af782b63b4737b2555f5184c

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityT-MOBILE USA, INC.

Victim entityT-MOBILE USA, INC.

Incidentdiscovered Sep 15, 2015

Stated responseExperian has notified appropriate federal, state and international law enforcement agencies

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com