T-Mobile Confirms Major Hack, Social Security Numbers And Drivers License Data Exposed

from the here-we-go-again dept

Earlier this week reports emerged that T-Mobile was investigating a massive hack of the company's internal systems, resulting in hackers gaining access to a massive trove of consumer information they were selling access to in underground forums. Initial estimates were that the personal details of 100 million customers had been accessed (aka all T-Mobile customers). After maintaining radio silence as it investigated the hack, T-Mobile has since released a statement detailing the scale of the intrusion. In short, it was smaller than initial claims, but still massive and terrible:

"Our preliminary analysis is that approximately 7.8 million current T-Mobile postpaid customer accounts’ information appears to be contained in the stolen files, as well as just over 40 million records of former or prospective customers who had previously applied for credit with T-Mobile. Importantly, no phone numbers, account numbers, PINs, passwords, or financial information were compromised in any of these files of customers or prospective customers."

While T-Mobile notes that none of the PINS used by former or prospective postpaid (billed regularly month to month) customers were accessed, T-Mobile does note that 850,000 active T-Mobile prepaid customers had their names, phone numbers and account PINs exposed. Many others had their social security numbers, drivers license/ID information, and other data exposed:

"Some of the data accessed did include customers’ first and last names, date of birth, SSN, and driver’s license/ID information for a subset of current and former postpay customers and prospective T-Mobile customers."

While it's understood why T-Mobile would collect some of this data during a credit check, it's not clear exactly why it needed to keep this data after the credit check is complete. This, again, is the kind of stuff you could tackle with a basic US privacy law with meaningful penalties for companies that keep getting hacked. For T-Mobile customers I think this is maybe the fifth or sixth time the company has been hacked since 2018. You have to think clear, basic, and consistently enforced federal guidelines and penalties would incentivize companies to not over-collect data and properly secure their systems.

Instead we stand around, shrug, complain that it's impossible or too hard to have competent governance on this subject, and nothing changes. And when consumers then get hacked (again), the best they get are platitudes like "free credit reporting," which prove utterly useless given they've received "free credit reporting" the last 75 times their data wasn't properly secured.

It's not clear how many of these kinds of repeated scandals we need to see before the federal government crafts some basic, competent guard rails, but it's abundantly clear that, thanks to a broad cross-industry coalition of lobbyists with near-unlimited budgets, it's not going to be anytime soon.

Filed Under: data breach, drivers licenses, hack, social security numbers
Companies: t-mobile

No Smiling On Your Drivers License. It Makes Our Software Sad

from the the-computer-makes-me-frown dept

We've discussed in the past how absolutely useless most facial recognition systems are. Their error rates (both types of errors) are way too high to be even remotely useful. At best, they're potentially (though, not definitely) useful for advertising purposes, where a false read isn't that big of a deal. However, apparently some states are using facial recognition software to try to make sure the photo on the license matches with other photos of the individual -- but the software sucks so bad that it can't recognize faces when you smile. So, the states using the software, Arkansas, Indiana, Virginia, or Nevada are supposedly telling people they can no longer smile on their driver's license photos. Apparently finding software that actually works wasn't an option.

Filed Under: drivers licenses, facial recognition, smiling

Opposition to REAL ID Continues to Grow

from the state-legislators-say-no dept

My colleague Jim Harper points out that the National Conference of State Legislatures has called for the repeal of the REAL ID Act. We last noted that the Department of Homeland Security was pretending that all 50 states were on schedule to implement the law, despite the fact that several of them had explicitly said they wouldn't implement it. Now it appears that a lot of state legislators are ready to take things a step further and call for the outright repeal of a law that many of them have refused to implement in their own states. The NCSL letter makes an excellent point that can't be emphasized enough: the worthwhile parts of REAL ID, such as making driver's licenses harder to forge, can be accomplished at the state level without getting the feds involved. States can take what's good from REAL ID and voluntarily incorporate it into their state identification systems without participating in a massive federal database that would become a magnet for identity theft.

Filed Under: drivers licenses, opposition, real id

French Drivers Renting Out Their Driving History Online

from the oui dept

A few months ago we discussed the practice of renting out one's credit score to people having trouble getting a loan. There didn't seem to be much justification for the scheme, as it's pretty clearly just a way to game the system. A similar practice is taking place in France, except instead of credit scores, people are renting out their good driving records. Basically, the way it works is that if someone commits a traffic violation that accrues points onto their license, they can pay someone else to take the fall. For the elderly, who have more use for cash than a clean driving record, the system works out pretty well. Of course, it doesn't do much to further the purpose of driving laws, which are there to keep bad drivers off the road. In most cases, letting the market find an optimal price for any good (in this case, a clean driving record) would be ideal. But for the safety of French drivers, it would probably be best if this loophole were closed.

Filed Under: drivers licenses