T-Mobile Says Hackers Stole Data on More Than 40 Million People

T-Mobile US Inc. said hackers took the Social Security numbers and other personal information of more than 40 million current and prospective customers, a brazen heist that could give criminals the digital keys to commit widespread online fraud.

The cellphone carrier said the stolen data included first and last names, birth dates, Social Security numbers and driver’s license information. The victims included people who applied for credit with T-Mobile—regardless of whether they ended up doing business with the carrier—and about 7.8 million current subscribers with postpaid plans.

Investigators say that stolen data has already been offered for sale in online forums and could eventually be used to commit fraud such as identity theft and SIM swapping—a form of identity theft in which hackers seize control of a victim’s mobile phone number.

“It’s probably the biggest gift to SIM-swappers they’ve received in years,’ said Allison Nixon, chief research officer at cyber services company Unit 221B.

“The typical life cycle of these databases is first they start off in the hands of the very few, but it will spread because people share data,” she said. “All of these hacked databases eventually go public.”