“We informed a very small number of customers that the SIM card assigned to a mobile number on their account may have been illegally reassigned or limited account information was viewed,” a T-Mobile spokesperson told BleepingComputer last week in response to questions about a new T-Mobile data breach. “This issue was quickly corrected by our team, using our in-place safeguards, and we proactively took additional protective measures on their behalf,” the spokesperson added. SIM swapping, also known as SIM hijacking, occurs when a bad actor convinces a carrier’s employee, either through social engineering or outright bribery, to reassign SIM cards. The bad actor then gains control of the user’s account, including all saved passwords. T-Mobile provides guidance on the issue in its account takeover support page.
