We want to let you know about a sophisticated attack that we recently identified and quickly shut down, which may have impacted some of your personal information.
Our Cybersecurity team recently identified and shut down a malicious attack against our email vendor that led to unauthorized access to certain T‑Mobile employee email accounts, some of which contained account information for T‑Mobile customers and employees. An investigation was immediately commenced, with assistance from leading cybersecurity forensics experts, to determine what happened and what information was affected. We immediately reported this matter to federal law enforcement and are actively assisting their investigation. T‑Mobile is in the process of notifying customers.
What Information Was Involved?
The personal information accessed could include names and addresses, Social Security numbers, financial account information, and government identification numbers, as well as phone numbers, billing and account information, and rate plans and features.
What We Are Doing
For customers that received a link from us to this webpage, we are also offering free credit monitoring and identity theft detection services, provided by TransUnion. Please refer to the Credit Monitoring section below for more information about these credit monitoring services and how to sign up.
We regret that this incident occurred. We take the security of customer information very seriously and while we have a number of safeguards in place to protect customer information from unauthorized access, we are also always working to further enhance security so we can stay ahead of this type of activity.
What You Can Do
We do not have any evidence that personal information contained in the affected accounts was used to commit fraud or otherwise misused. It is always a good idea to review your account information and update the personal identification number (PIN/passcode) on your T‑Mobile account. To do so, you can reach us by dialing 611 from your T‑Mobile phone or by calling 1-800-937-8997 from any phone. For additional resources regarding security on your account, please review our Privacy Resources at: https://www.t‑mobile.com/responsibility/privacy.
We also encourage you to consider the following:
- It is always a good idea to remain vigilant against threats of identity theft or fraud, and to regularly review and monitor your account statements and credit history for any signs of unauthorized transactions or activity.
- While we have no evidence that information acquired in this attack is being misused, if you ever suspect that you are the victim of identity theft or fraud, you have the right to file a report with the police or law enforcement. In addition, you may contact the FTC or your State Attorney General to learn more about the steps you can take to protect yourself against identity theft. The attachment following this letter has more information about steps you can take to protect yourself against identity theft or fraud.
- It is always a good idea to be alert for “phishing” emails by someone who acts like they know you or are a company that you may do business with and requests sensitive information over email, such as passwords, Social Security numbers, or bank account information. We do not ask for this type of information over email.
More information about how to protect yourself is available in the Additional Information Section.
I Didn’t Get a Notification. Should I Be Worried?
T‑Mobile is in the process of notifying customers. It is possible you didn’t hear from us because we don’t have up-to-date contact information for you, or you are no longer a T‑Mobile customer. If you want to find out whether your personal information was impacted, need further assistance, or have questions about this incident or your account, please contact Customer Care at your convenience. You can reach us by dialing 611 from your T‑Mobile phone, if you are a T‑Mobile customer, or by calling 1-800-937-8997 from any phone.
What Is T‑Mobile Doing to Prevent This from Happening Again?
How to Sign up for Credit Monitoring Services
We have arranged for you to enroll, at no cost to you, in an online credit monitoring service (myTrueIdentity) for two years provided by TransUnion Interactive, a subsidiary of TransUnion®, one of the three nationwide credit reporting companies.
To enroll in this service, go to the myTrueIdentity website at www.mytrueidentity.com and in the space referenced as “Enter Activation Code”, enter the 12-digit activation code that we sent you via letter to the address in our files, and follow the three steps to receive your credit monitoring service online within minutes.
If you do not have access to the Internet and wish to enroll in a similar offline, paper based, credit monitoring service, via U.S. Mail delivery, please call the TransUnion Fraud Response Services toll-free hotline at 1-855-288-5422 and enter the telephone passcode that we sent you via letter at your address in our files.
You can sign up for the online or offline credit monitoring service anytime between now and May 31, 2020. Due to privacy laws, we cannot register you directly. Please note that credit monitoring services might not be available for individuals who do not have a credit file with TransUnion, or an address in the United States (or its territories) and a valid Social Security number. Enrolling in this service will not affect your credit score.
Once you are enrolled, you will be able to obtain two years of unlimited access to your TransUnion credit report and credit score. The daily credit monitoring service will notify you if there are any critical changes to your credit file at TransUnion, including fraud alerts, new inquiries, new accounts, new public records, late payments, change of address and more. The service also includes access to an identity restoration program that provides assistance in the event your identity is compromised to help you restore your identity and up to $1,000,000 in identity theft insurance with no deductible. (Policy limitations and exclusions may apply.)
Additional Information to Protect Yourself
In addition to considering enrolling in credit monitoring services, it is always a good idea to remain vigilant, to review your account statements and to monitor your credit reports. Provided below are the names and contact information for the three major U.S. credit bureaus and additional information about steps you can take to obtain a free credit report and place a fraud alert or security freeze on your credit report. If you believe you are a victim of fraud or identity theft, you should contact your local law enforcement agency, your state’s attorney general, or the Federal Trade Commission.
INFORMATION ON OBTAINING A FREE CREDIT REPORT
U.S. residents are entitled under U.S. law to one free credit report annually from each of the three major credit bureaus. To order your free credit reports, visit www.annualcreditreport.com or call toll-free (877) 726-1014.
INFORMATION ON IMPLEMENTING A FRAUD ALERT OR SECURITY FREEZE
You can contact the three major credit bureaus at the addresses below to place a fraud alert on your credit report. A fraud alert indicates to anyone requesting your credit file that you suspect you are a possible victim of fraud. A fraud alert does not affect your ability to get a loan or credit. Instead, it alerts a business that your personal information might have been compromised and requires that business to verify your identity before issuing you credit. Although this may cause some short delay if you are the one applying for the credit, it might protect against someone else obtaining credit in your name.
A security freeze prohibits a credit reporting agency from releasing any information from a consumer’s credit report without written authorization. However, please be aware that placing a security freeze on your credit report may delay, interfere with, or prevent the timely approval of any requests you make for new loans, credit, mortgages, employment, housing or other services.
A credit reporting agency may not charge you to place, temporarily lift, or permanently remove a security freeze.
To place a fraud alert or security freeze on your credit report, you must contact the three credit bureaus below:
To request a security freeze, you will need to provide the following information:
- Your full name (including middle initial as well as Jr., Sr., II, III, etc.);
- Social Security Number;
- Date of birth;
- If you have moved in the past five (5) years, the addresses where you have lived over those prior five years;
- Proof of current address such as a current utility bill or telephone bill; and
- A legible photocopy of a government-issued identification card (state driver’s license or ID card, military identification, etc.).
You may also contact the U.S. Federal Trade Commission (“FTC”) for further information on fraud alerts, security freezes, and how to protect yourself from identity theft. The FTC can be contacted at 400 7th St. SW, Washington, DC 20024; telephone (877) 382-4357; or www.consumer.gov/idtheft.
Your state Attorney General may also have advice on preventing identity theft, and you should report instances of known or suspected identity theft to law enforcement, your State Attorney General, or the FTC. Contact information for these state attorneys general is also below.
Alabama Residents: The Attorney General can be contacted at 1-800-392-5658 or https://www.alabamaag.gov/consumercomplaint.
Alaska Residents: The Attorney General can be contacted at 1-888-576-2529; 1031 West 4th Ave., Suite 200, Anchorage, AK 99501-1994; or http://www.law.alaska.gov/department/civil/consumer/cp_complaint.html.
Arizona Residents: Visit the Attorney General’s website (https://www.azag.gov/consumer/data-breach/notification-form) to submit a notification of a data breach.
Arkansas Residents: The Attorney General can be contacted at 800-482-8982; consumer@ArkansasAG.gov; or https://arkansasag.gov/forms/file-a-consumer-complaint/.
California Residents: Visit the California Office of Privacy Protection (https://oag.ca.gov/privacy) for additional information on protection against identity theft.
Colorado Residents: The Attorney General can be contacted at 720-508-6000 or https://coag.gov/file-complaint/.
Connecticut Residents: The Attorney General can be contacted at 800-842-2649; 450 Columbus Boulevard, Suite 901, Hartford, CT, 06103-1840; or https://portal.ct.gov/DCP/Complaint-Center/Complaint-Forms-and-Procedures.
Delaware Residents: Visit the Delaware Fraud & Consumer Protection Division (https://attorneygeneral.delaware.gov/fraud/cpu/idtheft/) for additional information on protection against identity theft.
Florida Residents: The Attorney General can be contacted at 1-866-966-7226 or http://www.myfloridalegal.com/Contact.nsf/Contact?OpenForm&Section=Consumer_Protection_Division.
Hawaii Residents: Visit the Hawaii Department of Commerce and Consumer Affairs (https://cca.hawaii.gov/identity-theft-information/) for additional information on protection against identity theft.
Illinois Residents: The Attorney General can be contacted at 1-800-386-5438 or https://ccformsubmission.ilattorneygeneral.net/.
Indiana Residents: The Attorney General can be contacted at 1-800-382-5516 or https://www.in.gov/attorneygeneral/2895.htm.
Iowa Residents: The Attorney General can be contacted at Office of Attorney General of Iowa, Hoover State Office Building, 1305 E. Walnut Street, Des Moines, IA 50319; (515) 281-5164; or www.iowaattorneygeneral.gov.
Kentucky Residents: The Attorney General can be contacted at Office of the Attorney General of Kentucky, 700 Capitol Avenue, Suite 118 Frankfort, Kentucky 40601; www.ag.ky.gov; or 1-502-696-5300.
Louisiana Residents: The Attorney General can be contacted at 1-800-351-4889.
Maine Residents: The Attorney General can be contacted at 800-436-2131; email@example.com; 6 State House Station, Augusta, ME 04333; or https://www.maine.gov/ag/consumer/complaints/complaint_form.shtml.
Maryland Residents: The Attorney General can be contacted at Office of Attorney General, 200 St. Paul Place, Baltimore, MD 21202; (888) 743-0023; or www.oag.state.md.us.
Massachusetts Residents: The Attorney General can be contacted at 888-283-3757 or 501 Boylston Street, Ste. 5100, Boston, MA 02116.
Missouri Residents: The Attorney General can be contacted at 800-392-8222 or https://ago.mo.gov/app/consumercomplaint.
Montana Residents: The Attorney General can be contacted at 800-481-6896; P.O. Box 200151, Helena, MT 59620-0151; or firstname.lastname@example.org.
Nebraska Residents: The Attorney General can be contacted at 402-471-2682; 2115 State Capitol, Lincoln, NE 68509; or https://protectthegoodlife.nebraska.gov/data-breach-notification.
New Hampshire Residents: The Attorney General can be contacted at 1-888-468-4454; 33 Capitol Street, Concord, NH 03301; or email@example.com.
New Jersey Residents: The Attorney General can be contacted at 973-504-6200; 124 Halsey Street, Newark NJ 07102; or firstname.lastname@example.org.
New Mexico Residents: You have rights under the federal Fair Credit Reporting Act (FCRA), which governs the collection and use of information pertaining to you by consumer reporting agencies. For more information about your rights under the FCRA, please visit www.consumer.ftc.gov/articles/pdf-0096-fair-credit-reporting-act.pdf or www.ftc.gov.
New York Residents: The Attorney General can be contacted at 800-771-7755 or https://ag.ny.gov/contact-attorney-general-letitia-james.
North Carolina Residents: The Attorney General can be contacted at 9001 Mail Service Center, Raleigh, NC 27699-9001; (919) 716-6400; or www.ncdoj.gov.
North Dakota Residents: The Attorney General can be contacted at 1-800-472-2600 or email@example.com. For more information, please visit https://attorneygeneral.nd.gov/consumer-resources/consumer-complaints.
Oregon Residents: The Attorney General can be contacted at 1-877-877-9392 or https://justice.oregon.gov/consumercomplaints/OnlineComplaints/OnlineComplaintForm/en.
Puerto Rico Residents: The Puerto Rico Department of Consumer Affairs can be contacted at 787-722-7555.
Rhode Island Residents: The Attorney General can be contacted at 150 South Main Street, Providence, RI 02903; (401) 274-4400; or http://www.riag.ri.gov. You may also file a police report by contacting local or state law enforcement agencies.
South Carolina Residents: The Attorney General can be contacted at 844-835-5322 or www.consumer.sc.gov.
South Dakota Residents: The Attorney General can be contacted at 605-773-4400; 1302 E Hwy 14 Ste. 3, Pierre, SD 57501; or firstname.lastname@example.org.
Texas Residents: Visit the Texas Attorney General website (http://txoag.force.com/CPDOnlineForm) for its consumer complaint form.
Virginia Residents: The Attorney General can be contacted at 804-786-2042 or https://www.oag.state.va.us/consumercomplaintform/form/start.
Washington Residents: The Attorney General can be contacted at 206-464-6684 or 800 5th Ave. Ste. 2000, Seattle, WA 98104-3188. More information may be found at https://www.atg.wa.gov/fileacomplaint.aspx.