Q&A with John Binns, a 21-year-old American living in Turkey, who claims responsibility for the recent T-Mobile hack and says its security is “awful”
A 21-year-old American said he used an unprotected router to access millions of customer records in the mobile carrier's latest breach Tweets: @drewfitzgerald , @chrisbhoffman , @marcelolprince , @techjournalist , @tomgara , @trmcdonald , and @dnvolz Tweets: Drew FitzGerald / @drewfitzgerald : New: The Journal talked to the hacker who claimed credit for breaking into T-Mobile's network. He describes gates and records left unguarded by the cellphone carrier. https://www.wsj.com/... w/ @bobmcmillan Chris Hoffman / @chrisbhoffman : So is there a cellular carrier without awful security or are they all as bad as T-Mobile? https://twitter.com/... Marcelo Prince / @marcelolprince : “Their security is awful.” A 21-year-old American hacker says he used an unprotected @TMobile router to access millions of customer records. Read the @WSJ scoop by @DrewFitzGerald and @bobmcmillan https://www.wsj.com/... Sean Kerner / @techjournalist : Doesn't look like this was research done via a bug bounty program either .. which might be a good idea for T-Mobile https://twitter.com/... Tom Gara / @tomgara : Kind of amazing that the guy who did the massive T-Mobile hack is just like, doing an on-record interview with the WSJ about it, using his real name. https://www.wsj.com/... Tim McDonald / @trmcdonald : “The young hacker said he did it to gain attention. “Generating noise was one goal,” he wrote. He declined to say whether he had sold any of the stolen data or whether he was paid to breach T-Mobile. 🤔 https://www.wsj.com/... Dustin Volz / @dnvolz : “Their security is awful.” A 21-year-old American hacker, John Binns, told @WSJ he used an unprotected T-Mobile router to access millions of customer records. https://www.wsj.com/...
Context & Ripple Effects
This Q&A puts a face on T-Mobile's 2021 breach: John Binns, then 21 and living in Turkey, says he walked in through an unprotected router and found internal gates and records unguarded. His account matters less for the intrusion technique than for what followed — T-Mobile later disclosed in an SEC filing that a hacker had stolen data on roughly 37 million customers, keeping its breach disclosures in front of regulators for years.
The story also has a long tail: reporting in 2024 [[a:869224|linked Binns, by then incarcerated in Turkey and indicted over the T-Mobile hack, to the AT&T data breach]] that forced the carrier to begin notifying consumers after cybercriminals stole phone records covering nearly all of its cellular and landline customers.
First-order effects
- T-Mobile faces immediate scrutiny of its network perimeter, with Binns's claim that a single unprotected router exposed millions of customer records turning carrier security posture into a public talking point rather than a private audit finding.
- Millions of T-Mobile customers learn their names, addresses, and phone numbers were accessible, feeding the class-action and regulatory pressure that culminated in the company's later breach disclosures.
Second-order effects
- Rival carriers inherit the reputational cost: once Binns is linked to AT&T's breach of records touching nearly all of its customers, the industry-wide pattern of exposed telecom infrastructure — echoed in Chris Hoffman's question about whether any cellular carrier has non-awful security — forces competitors to treat carrier-grade security as a differentiator.
- Regulators gain a template case: a named, indicted hacker spanning breaches at multiple carriers strengthens the argument for mandatory breach-disclosure timelines at telecoms.
Third-order effects
- If the pattern holds — one actor tied to intrusions across T-Mobile and AT&T — US wireless security shifts from per-carrier incident response toward sector-level oversight, where repeated disclosures become a driver of regulation rather than isolated embarrassments.
The trend: US telecoms are moving from treating breaches as isolated incidents toward a recurring disclosure cycle in which named attackers span multiple carriers and push security toward sector-level regulatory scrutiny.