T-Mobile fined $60M following data breach

T-Mobile data breach fine overview: 

• Who: The Committee on Foreign Investment in the United States fined T-Mobile $60 million over a data breach the agency says occurred between August 2020 and June 2021.
• Why: The agency says T-Mobile’s failure to take appropriate measures to prevent unauthorized access to certain sensitive data during the incident violated a national security agreement it entered into in 2018 as part of its merger with Sprint.  
• Where: Consumers nationwide use T-Mobile as a telecom provider. 

The Committee on Foreign Investment in the United States fined T-Mobile $60 million in the wake of a data breach the agency determined occurred between August 2020 and June 2021. 

The CFIUS says T-Mobile violated a national security agreement, which the telecom company entered in 2018 as part of its merger with Sprint, by failing to take appropriate measures to prevent unauthorized access to certain sensitive data during the incident. 

The national security agreement was necessary due to the foreign ownership of the resulting post-merger entity, according to the CFIUS. 

The agency determined T-Mobile also failed to promptly report some incidents of unauthorized access, which it says delayed its efforts to investigate and mitigate any potential harm.”

“CFIUS concluded that these violations resulted in harm to the national security equities of the United States,” the agency says. 

T-Mobile says it is working with CFIUS to enhance compliance posture and obligations

T-Mobile is working with the CFIUS to“enhance its compliance posture and obligations, according to the agency, which says the company is also working with the United States to ensure compliance with its obligations going forward. 

A spokesperson for T-Mobile, which completed its acquisition of Sprint in April 2020, reportedly says in a statement that the company is glad to have reached a resolution in the case and will continue working cooperatively with the U.S. government. 

The spokesperson also says the penalty is the result of technical issues T-Mobile suffered following its merger with Sprint and maintains the incident was not a breach or intrusion and no bad actor was involved.

A consumer filed a class action lawsuit against T-Mobile in January 2023 over claims it failed to protect the private data of its customers during a separate data breach announced earlier that month. 

Were you affected by the T-Mobile data breach? Let us know in the comments.

Read About More Class Action Lawsuits & Class Action Settlements:

• National Public Data class actions allege company responsible for data breach affecting billions
• ADT confirms data breach that compromised customer data
• Consumers file multiple class actions over Acadian Ambulance data breach
• Delta says outage cost it $500M as CrowdStrike hits back over responsibility