By 
T-Mobile disclosed a new data breach in which a malicious actor stole the personal details of 37 million current postpaid and prepaid customer accounts through one of its Application Programming Interfaces (APIs).
An API is a software interface or mechanism commonly used by applications or computers to communicate with each other.
Many online web services use APIs so that their online apps or external partners can retrieve internal data as long as they pass the right authentication tokens.
T-Mobile revealed that the threat actor started stealing data using the impacted API around November 25, 2022. The company detected the malicious activity on January 5, 2023, and cut off the attacker's access to the API one day later.
The API abused in this security breach did not allow the attacker to gain access to affected customers' driver's licenses or other government ID numbers, social security numbers/tax IDs, passwords/PINs, payment card information (PCI) or other financial account info.
The impacted API could only provide a limited set of customer account data, including name, billing address, email, phone number, date of birth, T-Mobile account number and information such as the number of lines on the account and plan features.
After initial investigation, it was found that the attacker obtained data from this API for approximately 37 million current postpaid and prepaid customer accounts, though many of these accounts did not include the full data set.
T-Mobile has reported the incident to U.S. federal agencies and is now working with law enforcement to investigate the breach.
They have also started notifying the customers who might have had their sensitive personal information stolen as a result of this breach.
This is the first breach disclosed by T-Mobile since the start of the year while the company has disclosed seven other data breaches since 2018.
