HackingTelecom & MediaInformationStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryGovernment IDIdentity (basic)AuthenticationCriticalContained

T-MOBILE USA, INC.

bd_6c7de9e9876d5dac · schema v1 · pii pii-v1

Severity

Critical

Discovered

Aug 17, 2021

Filed

Aug 24, 2021

To disclose

7 days

Affected

2,079,648state residents only

Linked

7 filings

Confidence

69%

Full breach record for T-MOBILE USA, INC. →22 incidents on file

T-Mobile USA filed a supplemental notice with the Washington Attorney General regarding a July 2021 breach affecting ~2.08M WA residents. Unauthorized access occurred on or before July 19, 2021; discovered August 17, 2021. Data included SSN, DL, DOB, names, addresses, and PINs. Notices sent Aug 18-Oct 24, 2021. Forensic experts and law enforcement engaged. Free credit monitoring offered.

J jump to incidentP pin to compareR raw source

Washington clock✓ WA AG ≤30d7 days discovery → filing

Incident timeline

undetected · 29 days

discovery → filing · 7 days

Jul 19, 2021

Begins

Aug 17, 2021

Discovered

Aug 24, 2021

Filed

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

California State AGbd_b2fa46f7553069252021-08-25 · +1dVerified
Massachusetts State AGbd_6e3dba4ecc8166012021-08-26 · +2dVerified
Oregon State AGbd_f59f5dad6f2da02e2021-08-27 · +3dVerified
New Hampshire State AGbd_378732a40d9f790b2021-08-19 · +5dVerified

Show 2 more filings ↓up to 7d gap

Delaware State AGbd_f401f39a02cdaac62021-08-19 · +5dVerified
South Carolina State AGbd_4f029ec65fed3c952021-08-31 · +7dVerified

Name: T-MOBILE USA, INC.
norm: t mobile usa
Domain: t-mobile.com

Name: T-MOBILE USA, INC.
norm: t mobile usa
Domain: t-mobile.com
Industry: Telecom & Mediallm

Discovered: Aug 17, 2021
Breach occurred: Jul 19, 2021
Undetected for: 29 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 18, 2021
Affected individuals: 2,079,648state-resident count only
Data types: Government IDIdentity (basic)Authentication
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: ExternalFinancial
Regulator citations: Notified Washington State Attorney General's Office
Initial access: exploit_public_facing

During the incident: Shut the entry point used to gain access
Began a deep technical review with assistance from leading cybersecurity forensics experts
Engaged with federal law enforcement
Issued a national press release
Launched a website to provide more information
Offered two years of free credit monitoring and identity theft detection services
Reset T-Mobile prepaid PINs
Changes made: Enhanced security to stay ahead of this type of activity
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 days(7 days from discovery to filing)
Compliance flags: WA AG ≤30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 7 states

View merged incident ↗

New Hampshire State AGAug 19 · first

Delaware State AGAug 19 · first

Washington State AG+5d · this page

California State AG+6d

Massachusetts State AG+7d

Oregon State AG+8d

South Carolina State AG+12d

Pattern: first filing Aug 19 (NH), last Aug 31 (SC) — a 12-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA96.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 24, 2021
Raw hash: e87072b6324ec17af49f4f6fdb9c54d951f7b5108a6fce21a419dae0d1f17898

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityT-MOBILE USA, INC.

Victim entityT-MOBILE USA, INC.

Incidentdiscovered Aug 17, 2021

Stated responseShut the entry point used to gain access

ComplianceWA AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com