Hackers Steal Data From T-Mobile, Trying to Sell

By Jane McEntegart, published on June 10, 2009 at 8:50 AM
Source: Tom's Guide US | Keywords: , , , , | Themes: Smartphones
Syndication: Add to your Google homepage Add to My Yahoo!

A T-Mobile spokesperson has confirmed claims that the network’s customer database has been hacked and the attackers have made off with boatloads of data that they’re trying to sell.

Over the weekend, a message from the attackers was made public on the full disclosure mailing list. Claiming to have “everything” (from confidential documents and financial documents to scripts and programs from their servers) the hackers said they had already contacted competitors of T-Mobile, offering to sell the data but because they had received no response, they were ready to sell to the highest bidder.

According to eWeek, a spokesperson from T-Mobile said the company is unable to disclose additional information at this time, but stated customers “can be assured if there is any evidence that customer information has been compromised, we would inform those affected as quickly as possible."

Full transcript of the email is below (or click here to go directly to Full Disclosure):

Hello world,

The U.S. T-Mobile network predominately uses the GSM/GPRS/EDGE 1900 MHz frequency-band, making it the largest 1900 MHz network in the United States. Service is
available in 98 of the 100 largest markets and 268 million potential customers.

Like Checkpoint Tmobile has been owned for some time. We have everything, their databases, confidental documents, scripts and programs from their servers,
financial documents up to 2009.

We already contacted with their competitors and they didn't show interest in buying their data -probably because the mails got to the wrong people- so now we are
offering them for the highest bidder.

Please only serious offers, don't waste our time.

Contact: pwnmobile_at_safe-mail.net

[UPDATE] T-Mobile has said the data posted on Full Disclosure was not obtained by hacking into the company's system. According to PCWorld, T-Mobile said in a statement that the hackers did have legitimate T-Mobile data, but they didn't do it by hacking into the company's network. The statement went on to detail that there was no customer information contained in the document, nor does the T-Mobile security system show any evidence of a breach. A company spokes person refused to say how hackers got a hold of the information. Very fish indeed.

Comments | Print | Send to a friend
Slideshows related to this news

Sponsored links

Comments

jtt283 06/10/2009 3:15 PM
Show
Hanin33 06/10/2009 3:26 PM
Hide
-1+

these kinds of things makes me wonder why laws aren't enacted to punish these incompetent service providers and their lack of will or just plain ineptitude. these kind of security breaches should not be occurring. it is true that it is impossible to completely keep a system secure but they should be able to minimize the depth and time these 'hackers' have to run wild in their systems. i find it hard to believe that they do not have teams specifically assigned to monitor and track intrusions in their systems.

Hatecrime69 06/10/2009 3:37 PM
Hide
-2+

Yeah, like any of t-mobile's competitors would even consider such an act, if any of them did they would be in a serious world of legal hurt, like a giant 'sue me' sign on their foreheads

chripuck 06/10/2009 3:46 PM
Hide
--3+

Hanin33 :
these kinds of things makes me wonder why laws aren't enacted to punish these incompetent service providers and their lack of will or just plain ineptitude. these kind of security breaches should not be occurring. it is true that it is impossible to completely keep a system secure but they should be able to minimize the depth and time these 'hackers' have to run wild in their systems. i find it hard to believe that they do not have teams specifically assigned to monitor and track intrusions in their systems.



Did you not read the part where T-Mobile said there was no security breach? Reading comprehension FTW...

Hanin33 06/10/2009 4:15 PM
Hide
-4+

chripuck :
Did you not read the part where T-Mobile said there was no security breach? Reading comprehension FTW...



that was posted after i commented, hater. and i wouldn't trust wot they're saying after the fact. they can make their reports say wotever they wish them to say. if it can be proven the data is authentic then t-mobile's excuses mean very little. next!

duzcizgi 06/10/2009 4:18 PM
Hide
-4+

chripuck :
Did you not read the part where T-Mobile said there was no security breach? Reading comprehension FTW...


If you are competent enough to get in, through the firewall, and were able to copy the databases etc. over, then you should be competent enough to clear up your traces as well. Even in the dawn of computer networks & hacking, hackers were clearing their traces as soon as they're finished with what they are doing. So, "security isn't breached" means just "we don't have any logs stating that someone entered our network".
So, not having logs, does it really mean that nobody entered, or, someone entered and then cleared up all the logs regarding her when she's finished?

Parrdacc 06/10/2009 4:31 PM
Hide
-5+

I don't know. Something just feels wrong here. This is about the fourth story I have read or heard about in the last 6 months that follows the same pattern. Hackers steal confidential, either/or customer and company, information then publicly claim they have it and try and get money for it. Not saying it is not possible and not saying it isn't even true; just seems a lot of this going around to make me think that the maybe it is not all hackers. Perhaps it is some sort of new Nigeria scam. Just a thought.

danimal_the_animal 06/10/2009 4:58 PM
Hide
-3+

Parrdacc :
I don't know. Something just feels wrong here. This is about the fourth story I have read or heard about in the last 6 months that follows the same pattern. Hackers steal confidential, either/or customer and company, information then publicly claim they have it and try and get money for it. Not saying it is not possible and not saying it isn't even true; just seems a lot of this going around to make me think that the maybe it is not all hackers. Perhaps it is some sort of new Nigeria scam. Just a thought.



Exactly....What if the T-mobile Administrators SUCK AT THEIR JOB!!!!

they can tell their bosses..."Nah...nobody hacked us" just so that they can keep their jobs....heck...what if they were too stupid to know what happened.....or are not competent enough to see an attack that is right in front of their face.

You would have to BE a hacker in order to spot a hack.....no experience in this field= unable to detect problem.....It's like going into a pitch black closet trying to find something....Not going to happen.....


So their is a 50/50 chance that the T-mobile network admins either know what to look for or not

scook9 06/10/2009 4:59 PM
Hide
-2+

Guess I DON'T need a mobile makeover after all, even from Catherine Zeta-Jones.

Kill@dor 06/10/2009 5:20 PM
Hide
-1+

I don't understand how they got this info without hacking. Its either an inside job, or the hackers did hack un-noticed in the network (i.e. they obtained usernames and passwords somehow).

Anonymous 06/10/2009 5:22 PM
Hide
-1+

From the way the article made it sound, it's more than likely that it was an inside job, rather than "hackers". Some irate employee probably made a copy of some files and tried to make a buck by selling them.

danimal_the_animal 06/10/2009 5:25 PM
Hide
-2+

SO THEY SAY!

Hackers say they stole data.

Admins are not sure.....

until they can prove or disprove it without a doubt I say for the time being it is plausible.

danimal_the_animal 06/10/2009 5:28 PM
Hide
-0+

If nothing comes of this in 30 days....it is all lies.

If it DOES turn out they got hacked...People WILL be getting fired!

NuclearShadow 06/10/2009 5:35 PM
Hide
-0+

I wouldn't trust T-mobile's word. They have reason to lie to make their customers feel comfortable to continue using T-mobiles service.

Ciuy 06/10/2009 5:40 PM
Hide
-0+

bs they hacked their crap security system, and now they say they got the data in another way so ppl dont think T-mobile securty is breached.

IT IS !!!

Hanin33 06/10/2009 5:57 PM
Hide
-1+

scook9 :
Guess I DON'T need a mobile makeover after all, even from Catherine Zeta-Jones.



tanks... i needed a laugh... ;)

rockabye 06/10/2009 6:04 PM
Hide
-4+

Whether they got the data by hacking, walking out of the building with boxes of backup tapes, or using a Jedi mind trick doesn't matter. It's still a security issue which the company is responsible for. To announce that it wasn't done through hacking doesn't change anything.

grieve 06/10/2009 6:22 PM
Hide
-0+

T-Mobile should hire a 3rd party to investigate if they have been hacked or not.
I figure if the network is insecure and got hacked.. .someone should be unemployeed.

Anonymous 06/10/2009 6:58 PM
Hide
-0+

Haha pwnmobile, I like that name.

The real point being is you can't always stop a good hacker no matter how good you are at security, you can only detect them so they don't get away with it.

Imagine that the T-mobile admins are awesome, they detected the intrusion and brought it to the executive staff. Do you really think they will admit it? They would if the punishment for non-disclosure was worse than the theft. This is why there needs to be a harsh law.

magicandy 06/10/2009 7:38 PM
Hide
-4+

All these hacker horror stories lately are hitting the front pages for a reason. It's all just a part of the US govt's plan to regulate and control the internet, in much the same way as China. Don't believe it if you don't want to, but it's coming. We're going to start hearing more and more about "hackers" digging deeper into crucial systems. It will come to the point where "hacker" will be almost synonymous with "terrorist", and the government will have "no choice" but to regulate and control the US net to increase "security".

utopic 06/10/2009 8:29 PM
Hide
-2+

magicandy :
All these hacker horror stories lately are hitting the front pages for a reason. It's all just a part of the US govt's plan to regulate and control the internet, in much the same way as China. Don't believe it if you don't want to, but it's coming. We're going to start hearing more and more about "hackers" digging deeper into crucial systems. It will come to the point where "hacker" will be almost synonymous with "terrorist", and the government will have "no choice" but to regulate and control the US net to increase "security".


you are so right...

duzcizgi 06/10/2009 9:44 PM
Hide
-0+

magicandy :
All these hacker horror stories lately are hitting the front pages for a reason. It's all just a part of the US govt's plan to regulate and control the internet, in much the same way as China. Don't believe it if you don't want to, but it's coming. We're going to start hearing more and more about "hackers" digging deeper into crucial systems. It will come to the point where "hacker" will be almost synonymous with "terrorist", and the government will have "no choice" but to regulate and control the US net to increase "security".



I also tend to agree with you. Fight against hackers is done by closing security holes in systems, not by plugging into the wire. In fact, even if they'll be recording and regulating everything, a knowledgeable hacker will be able to work around those stuff as easy as entering a network. But as with the governments, it will make them possible to make normal people's lives a hell. (Have you ever noticed the insane *security* levels which, if you are a normal person, a real pain in the ***. But if you are a determined terrorist, I'm sure you'd find a way to down that plane.)

Luscious 06/10/2009 10:10 PM
Hide
-0+

scook9 :
Guess I DON'T need a mobile makeover after all, even from Catherine Zeta-Jones.


If she came knocking on my door, I would do her a big favor.

doomtomb 06/10/2009 10:30 PM
Hide
-1+

Quote :Very fish indeed.

Tuna or salmon?

Anonymous 06/11/2009 12:01 PM
Hide
-1+

Very important difference I feel I should point out, a hacker is someone that modifies things to do what they want (building a computer in a microwave case, construction their own firewall, etc...), crackers are people (usually a hacker) that break into computer systems. Don't believe me? Look it up. Same as the difference between black hat and white hat.

ProDigit80 06/11/2009 1:34 AM
Hide
-0+

If I where a concurrent company, I would buy the data, immediately seal it (preferably without reading it), contact a lawyer, and get the legal system working.

It would be an honorable deed!

You always have to think: "what would I want if someone stole and sold my company data to concurrence?, what would I want the other company to do?"

Even if they don't have real data, and are bluffing, they can be sewed for not selling the material they agreed on on the sale.
There are a lot of crimes on selling other company data; good for 5 or 10 years behind bars!

rantsky 06/11/2009 2:02 AM
Hide
-0+

I call it fake...

Nonetheless, if this is for real, my suggestion to T-Mobile:
SPAM THEM TO DEATH!!

Fill them up with so many fraudulent "buy offers" they never find the real ones. Pour emails on them in the thousands. At least it should keep them occupied until they're tracked down..

okibrian 06/11/2009 2:27 AM
Hide
-0+

"The statement went on to detail that there was no customer information contained in the document, nor does the T-Mobile security system show any evidence of a breach."

Then they have no intrusion detection and/or logging. Don't worry people; your information was not compromise because T-Mobile said so. I am also Santa... because I say so. Maybe T-Mobile does not want to lose customers for compromising data.

danieljaegerfilms 06/12/2009 8:40 PM
Hide
-0+

Good thing I have AT&T :)

danieljaegerfilms 06/12/2009 8:52 PM
Hide
-0+

Good thing I have AT&T :)

Anonymous 06/13/2009 5:48 AM
Hide
-1+

Oh yea, AT&T, better data security, substantially inferior network. I'm sure you're happy.

Sponsored links