Washington AG files lawsuit against T-Mobile over 2021 data breach

T-Mobile lawsuit overview: 

• Who: Washington state Attorney General Robert W. Ferguson filed a lawsuit against T-Mobile. 
• Why: Ferguson claims T-Mobile failed to adequately secure the personally identifiable information of more than 2 million Washington consumers during an August 2021 data breach. 
• Where: The lawsuit was filed in King County Superior Court in Washington State. 

T-Mobile failed to adequately secure the personally identifiable information of more than 2 million Washington State consumers during an August 2021 data breach, a new lawsuit filed by the state alleges. 

Washington state Attorney General Robert W. Ferguson claims T-Mobile misled the public into believing the company would properly safeguard customer data, when, despite its statements, the T-Mobile data breach was a “direct result” of the company’s “lack of accountability.” 

“T-Mobile made these statements despite a history of data breaches and cybersecurity incidents in addition to, as explained above, lacking accountability in data security governance,” the T-Mobile lawsuit alleges.

Ferguson claims T-Mobile violated Washington’s Consumer Protection Act (CPA) by making the misleading assurances and by failing to adequately implement cybersecurity measures and address known vulnerabilities. 

T-Mobile failed to adhere to internal cybersecurity policies, lawsuit claims

Ferguson claims T-Mobile failed to adhere to internal cybersecurity policies and “recognized industry standards” and ignored its own internal reports that warned of the vulnerabilities that he claims eventually “led to and exacerbated” the T-Mobile data breach.

The state claims T-Mobile also failed to provide adequate notice of the data breach to certain affected Washington consumers — in a further violation of the CPA — and that the notification that was sent out left out critical information and downplayed its severity. 

“Without the pertinent information needed to take steps, or realize steps were needed, to protect their information, those consumers were left vulnerable to fraud and identity theft from nefarious actors,” the T-Mobile lawsuit says. 

Washington State requests injunctive relief and for T-Mobile to be assessed civil penalties for each and every violation of the CPA. 

T-Mobile previously agreed to pay $350 million to put an end to a class action lawsuit arguing the company failed to prevent the data breach, which affected 76 million consumers nationwide. 

Were you affected by the T-Mobile data breach? Let us know in the comments.

Washington is represented by state Attorney General Robert W. Ferguson as well as Mina Shahin, Kathleen Box, Gardner Reed and Bret Finkelstein of the Office of the Attorney General. 

The T-mobile lawsuit is State of Washington v. T-Mobile US Inc., et al., Case No. 25-2-00308-6 SEA, in the State of Washington King County Superior Court. 

Read About More Class Action Lawsuits & Class Action Settlements:

• H&R Block class action alleges negligence in data breach
• Visionworks data breach compromised info of about 40K customers, class action claims
• Norwex class action claims data breach exposed personal identifying info
• American Addiction Centers data breach affected 400K+, class action claims