An API bug on T-Mobile's staff-facing website, since fixed, let anyone gain access to customer addresses, account PINs, and other details using a phone number
Zack Whittaker / ZDNet :
Context & Ripple Effects
T-Mobile's data-exposure problem is a repeat offense, not a one-off. In 2015, sister brand MetroPCS left subscriber personal data open through its own website (the 'nasty' MetroPCS bug), and Target's wish-list app showed how an unauthenticated API can leak customer records at scale. This staff-facing API bug extends that lineage to the carrier itself.
The fix announced here did not end the story: months later, researchers traced a flaw letting attackers brute-force account PINs — likely through the same faulty API — after initiating a purchase on Apple's online store (the PIN brute-force flaw), and by 2021 T-Mobile was investigating a breach touching phone numbers, SSNs, and driver's license data for over 100 million people (the 2021 breach investigation).
First-order effects
- Any T-Mobile customer whose phone number was known could have had their home address and account PIN pulled by a stranger until the fix shipped, making SIM-swap-style social engineering materially easier against exactly those subscribers.
Second-order effects
- The exposed PINs fed directly into the later brute-force attack chain routed through Apple's online store, turning a read-only leak into account-takeover ammunition.
Third-order effects
- With MetroPCS, Sprint-via-Samsung, and T-Mobile all leaking customer data through web APIs across six years, carrier retail and support endpoints are emerging as a systemic weak layer — the kind of recurring pattern that invites regulator attention on how telecoms authenticate every endpoint touching subscriber records.
The trend: Carrier customer-data breaches are converging on a single root cause — under-secured internal APIs — and each new incident raises the odds that telecom endpoint authentication becomes a regulated requirement rather than an engineering choice.