<story><title>T-Mobile Database Breach Exposes 2M Customers&apos; Data</title><url>https://www.databreachtoday.com/t-mobile-database-breach-exposes-2-million-customers-data-a-11420</url></story><parent_chain><item><author>seibelj</author><text>I have T-Mobile. 6 weeks ago my phone could no longer access the cell network. The support agent told me that someone went into a store, claimed to be me, and was able to change the SIM card. The history showed the employee in the store verified me by my driver&amp;#x27;s license. We changed the SIM back and supposedly locked the account.&lt;p&gt;I use Google Auth OTP for all the accounts that I can, and as far as I can tell nothing was breached or stolen, but I wouldn&amp;#x27;t rely on your cell phone or number for anything whatsoever, it&amp;#x27;s way too easy to socially engineer, or have some easily corruptible retail employee steal from you.</text></item></parent_chain><comment><author>rm999</author><text>T-mobile is horrible with security. They have this service called Digits, which lets users access their phone number from other devices. The problem is, this subverts the security model a lot of the American internet ecosystem is built on, i.e. your phone number will be secure online. Someone got into my t-mobile account and enabled Digits, then had free-reign on my gmail, texts, paypal, etc (I don&amp;#x27;t use the strongest passwords, but always keep 2-factor authentication on important services like these). Every time I got hacked I&amp;#x27;d spend a couple hours of trying to figure out how, and the T-mobile agents would always claim no one accessed my number. Finally, the third time, I escalated up the security chain within T-mobile and they figured out the issue.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.t-mobile.com&amp;#x2F;offers&amp;#x2F;t-mobile-digits&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.t-mobile.com&amp;#x2F;offers&amp;#x2F;t-mobile-digits&lt;/a&gt;</text></comment>
<story><title>T-Mobile Database Breach Exposes 2M Customers&apos; Data</title><url>https://www.databreachtoday.com/t-mobile-database-breach-exposes-2-million-customers-data-a-11420</url></story><parent_chain><item><author>seibelj</author><text>I have T-Mobile. 6 weeks ago my phone could no longer access the cell network. The support agent told me that someone went into a store, claimed to be me, and was able to change the SIM card. The history showed the employee in the store verified me by my driver&amp;#x27;s license. We changed the SIM back and supposedly locked the account.&lt;p&gt;I use Google Auth OTP for all the accounts that I can, and as far as I can tell nothing was breached or stolen, but I wouldn&amp;#x27;t rely on your cell phone or number for anything whatsoever, it&amp;#x27;s way too easy to socially engineer, or have some easily corruptible retail employee steal from you.</text></item></parent_chain><comment><author>hippich</author><text>Similar thing happened to me about a year ago. The creepiest part was - it happened while I was in the international flight and my gmail WAS on sms &amp;quot;two factory&amp;quot; authentication... Since then everywhere i can I used OTP, but some sites fallback to use your phone number if you can&amp;#x27;t provide OTP password... So I have to enter some completely invalid phone number there to make it impossible.</text></comment>