T-Mobile Fined $31.5 Million by FCC for 4 Data Breaches: A Shocking Wake-Up Call

Imagine this: you receive a text message from your bank with a one-time password to access your account. You trust that the information is secure, right? Unfortunately, that’s not always the case. Today, I want to talk about a recent settlement involving T-Mobile and the Federal Communications Commission (FCC) over multiple data breaches that compromised the personal information of millions of U.S. consumers.

A $31.5 Million Settlement

The FCC announced a $31.5 million settlement with T-Mobile over a series of cybersecurity incidents and resulting data breaches that impacted the company’s customers in 2021, 2022, and 2023. These breaches included an API incident and a sales application breach. As part of the settlement, T-Mobile must invest $15.75 million in cybersecurity enhancements and pay an additional $15.75 million civil penalty to the U.S. Treasury.

Moreover, T-Mobile committed to implementing more robust security measures, such as adopting modern cybersecurity frameworks like zero-trust architecture and multi-factor authentication to resist phishing attacks. In the words of FCC Chairwoman Jessica Rosenworcel, “Today’s mobile networks are top targets for cybercriminals. Consumers’ data is too important and much too sensitive to receive anything less than the best cybersecurity protections.”

What T-Mobile Plans to Do

As part of the agreement, T-Mobile is committed to enhancing privacy, data security, and cybersecurity practices by:

• Providing regular cybersecurity updates through the company’s Chief Information Security Officer to the board of directors for greater oversight and governance,
• Adopting data minimization, data inventory, and data disposal processes to limit the collection and retention of customer information,
• Detecting and tracking critical network assets to prevent misuse or compromise,
• Working toward implementing a modern zero-trust architecture, segmenting its networks to improve security,
• Assessing information security practices through independent third-party audits,
• Adopting multi-factor authentication across company systems to block breach risks linked to leakage, theft, and the sale of stolen credentials.

FCC’s Enforcement Bureau Chief, Loyaan A. Egal, added, “With companies like T-Mobile and other telecom service providers operating in a space where national security and consumer protection interests overlap, we are focused on ensuring critical technical changes are made to telecommunications networks to improve our national cybersecurity posture and help prevent future compromises of Americans’ sensitive data.”

Previous FCC Actions

The FCC’s Privacy and Data Protection Task Force, established in 2023, played a central role in this investigation and settlement. Similar settlements were reached with AT&T in September 2024 ($13 million) and Verizon on behalf of its subsidiary TracFone Wireless in July 2024 ($16 million).

In April 2024, the FCC also fined the largest U.S. wireless carriers almost $200 million for sharing their customers’ real-time location data without their consent. These fines included $12 million for Sprint, $80 million for T-Mobile, more than $57 million for AT&T, and almost $47 million for Verizon.

In February, the FCC updated its data breach reporting rules, requiring telecom companies to report data breaches impacting their customers’ personally identifiable information within 30 days.

What This Means for You

As a consumer, it’s essential to stay informed about the security measures taken by companies to protect your sensitive data. This settlement is a reminder that we must hold telecommunications providers accountable for keeping our personal information safe.

At IT Services, we understand the importance of cybersecurity and are dedicated to helping you stay informed and protected. To learn more about how to keep your data secure and receive the latest updates on cybersecurity, don’t hesitate to contact us and keep coming back for more information.