US reaches $31.5 million settlement with T-Mobile over data breaches

T-Mobile has reached a $31.5 million settlement to resolve a Federal Communications Commission investigation into three years of significant data breaches that affected tens of millions of U.S. consumers. the agency announced on Monday.

T-Mobile will pay a civil penalty of $15.75 million and agreed to spend an additional $15.75 million over two years to strengthen its cybersecurity program. The FCC said T-Mobile suffered data breaches in 2021, 2022 and 2023 that affected millions of current, former or potential T-Mobile customers.

The 2021 breach alone affected 76.6 million US consumers, while a 2023 breach affected 37 million, the FCC said.

The FCC said T-Mobile, the nation’s third-largest mobile carrier with 119.7 million customers, will address “fundamental security flaws, work to improve cyber hygiene and adopt robust modern architectures such as zero trust and phishing-resistant multi-factor authentication”.

“Today’s mobile networks are prime targets for cybercriminals,” said FCC Chair Jessica Rosenworcel. “We will continue to send a strong message to providers entrusted with this sensitive information that they need to harden their systems or there will be consequences.”

T-Mobile did not immediately respond to a request for comment.

Earlier this month, the FCC said AT&T agreed to pay $13 million to settle an investigation into a January 2023 cloud provider data breach that affected 8.9 million AT&T wireless customers .

AT&T disclosed in July a separate massive hacking incident in April that led to the illegal download of about 109 million customer accounts that are under FCC investigation.

In July, the FCC said Verizon’s TracFone Wireless agreed to pay $16 million for the data breach and implement reforms.

(Reporting by Shepardson; Editing by Leslie Adler)