FEDERALItem 8.01 · voluntaryHackingTelecom & MediaInformationAbuse Of FunctionalityData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)CriticalContained

T-MOBILE US, INC.

bd_e55b552517d3671c · schema v1 · pii pii-v1

Severity

Critical

Discovered

Jan 5, 2023

Filed

Jan 19, 2023

To disclose

14 days

Affected

37,000,000

Confidence

65%

Full breach record for T-MOBILE US, INC. →5 incidents on file

T-Mobile US, Inc. disclosed that a bad actor obtained data through an unauthorized API access starting around November 25, 2022. The company identified the activity on January 5, 2023, and contained it within a day. Approximately 37 million customer accounts were affected, exposing basic identity information such as name, address, email, phone number, and date of birth. Sensitive data like SSNs and payment card information was not accessed.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 41 days

discovery → filing · 14 days

Nov 25, 2022

Begins

Jan 5, 2023

Discovered

Jan 19, 2023

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed37,000,000 affectedView incident

Name: T-MOBILE US, INC.
norm: t mobile us
SEC CIK: 0001283699

Name: T-MOBILE US, INC.
norm: t mobile us
SEC CIK: 0001283699
Industry: Telecom & Mediallm

Discovered: Jan 5, 2023
Breach occurred: Nov 25, 2022
Undetected for: 41 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 37,000,000nationwide
Data types: Identity (basic)
Attack vector: Unauthorized Access
Threat actor: External
Regulator citations: Notified certain federal agencies about the incident

During the incident: Commenced an investigation with external cybersecurity experts
Traced the source of the malicious activity and stop it
Notified certain federal agencies about the incident
Working with law enforcement
Begun notifying customers whose information may have been obtained
Changes made: Continuing to make substantial investments to strengthen our cybersecurity program
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 days(14 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/1283699/000119312523010949/
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jan 19, 2023
Raw hash: 356bb395354fe7e2d527afaf59fd9198c88487b31c264947a586b69b325a010f

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html32.8 KB

Download View at source

Reporting entityT-MOBILE US, INC.

Victim entityT-MOBILE US, INC.

Incidentdiscovered Jan 5, 2023

Stated responseCommenced an investigation with external cybersecurity experts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing