A T-Mobile spokesperson has confirmed claims that the network’s customer database has been hacked and the attackers have made off with boatloads of data that they’re trying to sell.
Over the weekend, a message from the attackers was made public on the full disclosure mailing list. Claiming to have “everything” (from confidential documents and financial documents to scripts and programs from their servers) the hackers said they had already contacted competitors of T-Mobile, offering to sell the data but because they had received no response, they were ready to sell to the highest bidder.
According to eWeek, a spokesperson from T-Mobile said the company is unable to disclose additional information at this time, but stated customers “can be assured if there is any evidence that customer information has been compromised, we would inform those affected as quickly as possible."
Full transcript of the email is below (or click here to go directly to Full Disclosure):
Hello world,
The U.S. T-Mobile network predominately uses the GSM/GPRS/EDGE 1900 MHz frequency-band, making it the largest 1900 MHz network in the United States. Service is
available in 98 of the 100 largest markets and 268 million potential customers.
Like Checkpoint Tmobile has been owned for some time. We have everything, their databases, confidental documents, scripts and programs from their servers,
financial documents up to 2009.
We already contacted with their competitors and they didn't show interest in buying their data -probably because the mails got to the wrong people- so now we are
offering them for the highest bidder.
Please only serious offers, don't waste our time.
Contact: pwnmobile_at_safe-mail.net
[UPDATE] T-Mobile has said the data posted on Full Disclosure was not obtained by hacking into the company's system. According to PCWorld, T-Mobile said in a statement that the hackers did have legitimate T-Mobile data, but they didn't do it by hacking into the company's network. The statement went on to detail that there was no customer information contained in the document, nor does the T-Mobile security system show any evidence of a breach. A company spokes person refused to say how hackers got a hold of the information. Very fish indeed.
Did you not read the part where T-Mobile said there was no security breach? Reading comprehension FTW...
that was posted after i commented, hater. and i wouldn't trust wot they're saying after the fact. they can make their reports say wotever they wish them to say. if it can be proven the data is authentic then t-mobile's excuses mean very little. next!
If you are competent enough to get in, through the firewall, and were able to copy the databases etc. over, then you should be competent enough to clear up your traces as well. Even in the dawn of computer networks & hacking, hackers were clearing their traces as soon as they're finished with what they are doing. So, "security isn't breached" means just "we don't have any logs stating that someone entered our network".
So, not having logs, does it really mean that nobody entered, or, someone entered and then cleared up all the logs regarding her when she's finished?
Exactly....What if the T-mobile Administrators SUCK AT THEIR JOB!!!!
they can tell their bosses..."Nah...nobody hacked us" just so that they can keep their jobs....heck...what if they were too stupid to know what happened.....or are not competent enough to see an attack that is right in front of their face.
You would have to BE a hacker in order to spot a hack.....no experience in this field= unable to detect problem.....It's like going into a pitch black closet trying to find something....Not going to happen.....
So their is a 50/50 chance that the T-mobile network admins either know what to look for or not
Hackers say they stole data.
Admins are not sure.....
until they can prove or disprove it without a doubt I say for the time being it is plausible.
If it DOES turn out they got hacked...People WILL be getting fired!
IT IS !!!
tanks... i needed a laugh...
I figure if the network is insecure and got hacked.. .someone should be unemployeed.
The real point being is you can't always stop a good hacker no matter how good you are at security, you can only detect them so they don't get away with it.
Imagine that the T-mobile admins are awesome, they detected the intrusion and brought it to the executive staff. Do you really think they will admit it? They would if the punishment for non-disclosure was worse than the theft. This is why there needs to be a harsh law.