T-Mobile Data Breach Is Reminder to Practice Your Own Cybersecurity

And so a massive illegal, international underground economy has emerged to serve the needs of scammers. The wares? More than 15 billion pieces of stolen personal data, according to law enforcement and cybersecurity experts with the firm Digital Shadows. That sounds like a lot of data, but it isn’t.

The average person logs in to nearly 200 sites that require passwords or other information, Digital Shadows estimates. Sitting in your computer are endless amounts of personal data that may be useful to a scammer. And so another illegal industry is constantly at work: data stealing.

A near record 1,802 publicly reported breaches of large-organization customer databases occurred in 2022, according to the Identity Theft Resource Center. Most of that data ends up in this dark web marketplace, being bought and sold.

If this info marketplace were an actual mall, the people you’d find there primarily would be hackers who steal the information and sell it in bulk, malicious code writers who help those hackers gain access to your computer by infecting it with malware, and vendors who buy the stolen data, repackage it and sell it to the “end users” — the people actually trying to ensnare you in a scam.

“While no information was obtained for impacted customers that would compromise the safety of customer accounts or finances, we want to be transparent with our customers and ensure they are aware,” T-Mobile wrote in a statement. “No passwords, payment card information, Social Security numbers, government ID numbers or other financial account information were compromised.”

Even if that’s so, risks remain. On his KrebsOnSecurity blog, cybersecurity expert Brian Krebs wrote: “There are currently no signs that hackers are selling this data haul from T-Mobile. But if the past is any teacher, much of it will wind up posted online soon. It is a safe bet that scammers will use some of this information to target T-Mobile users with phishing messages, account takeovers and harassment.”

How much is your personal identifiable information (PII) worth to scam artists? While many people think a nine-digit Social Security number is their most valuable identifier, “it’s actually worth about $2,” says James E. Lee, chief operating officer of the nonprofit Identity Theft Resource Center in San Diego.

If a Social Security number comes with a name and date of birth, it’s $4 or $5, or about “the cost of a caramel macchiato,” Krebs says. 

A person’s credit card information is worth more, about $25 to $35, Lee says. A hacked Facebook account can bring $65, and a selfie photo with a U.S. driver’s license, $100.

Who’s buying this information?

“There are hundreds of thousands of serious ‘threat actors’ throughout the world,” says Robert Villanueva, a retired U.S. Secret Service supervisor who’s now executive vice president of Q6 Cyber in Hollywood, Florida.

This personal data is sold in digital “shops” on the dark web, as well as in more exclusive online “forums” accessible to more sophisticated cybercriminals, Villanueva says. 

Malware, or malicious software, is critical to their crimes — because if a computer is compromised with what’s called a keylogger, every letter a person types is revealed to the bad guys, who can grab banking and email credentials and take over these accounts.

Your smartphone is also targeted. “Threat actors are really going after people’s phone numbers to hijack their digital lives, because that’s the weakest link,” Krebs says.

This story, originally published April 1, 2022, has been updated to reflect a major T-Mobile data breach.