T-Mobile is investigating unconfirmed claims made this weekend to the Full Disclosure mailing list by hackers bragging that they’ve infiltrated company servers.
Full Disclosure is an unmoderated forum that exists to notify people of possible security vulnerabilities. The post, reading a bit like a Craigslist ad, gives scant details of the alleged breach but offers information to the highest bidder.
Like Checkpoint[,] Tmobile has been owned for some time. We have everything, their databases, confidental documents, scripts and programs from their servers, financial documents up to 2009.
We already contacted with their competitors and they didn’t show interest in buying their data -probably because the mails got to the wrong people- so now we are offering them for the highest bidder.
Please only serious offers, don’t waste our time.
Whether T-Mobile has indeed been pwned remains to be seen- but posters claiming to be former T-Mobile employees appear to be corroborating formats as matching those they worked with while in the company’s employ. Skeptics say that a large-scale attack involving such a massive amount of data would be likely better executed, however, as a buyer for the alleged data has not been found. Now that T-Mobile is aware of a potential breach, the value of any stolen data is considerably reduced.
In a statement, T-Mobile had this to say:
“Regarding the recent claim, we are fully investigating the matter. As is our standard practice, if there is any evidence that customer information has been compromised, we would inform those affected as soon as possible.”
