The US reaches a $31.5 million settlement with T-Mobile over data breaches

By David Shepardson

WASHINGTON (Reuters) – T-Mobile has reached a $31.5 million settlement to end a Federal Communications Commission investigation into major data breaches over three years that affected tens of millions of U.S. consumers , the agency said on Monday.

T-Mobile will pay a $15.75 million civil penalty and has agreed to spend an additional $15.75 million over two years to strengthen its cybersecurity program. According to the FCC, T-Mobile experienced data breaches in 2021, 2022 and 2023 that affected millions of current, former or potential T-Mobile customers.

The 2021 breach alone affected 76.6 million U.S. consumers, while a 2023 breach affected 37 million, the FCC said.

The FCC said T-Mobile, the country's third-largest wireless carrier with 119.7 million customers, will “address fundamental security vulnerabilities, work to improve cyber hygiene, and implement robust modern architectures such as zero trust and phishing-resistant multi-factor authentication.” introduce.”

“Today’s mobile networks are top targets for cybercriminals,” said FCC Chairwoman Jessica Rosenworcel. “We will continue to make it clear to providers entrusted with this sensitive information that they must strengthen their systems or there will be consequences.”

T-Mobile said Monday that it “takes our responsibility to protect our customers' information very seriously,” adding that it has “made and will continue to make significant investments in strengthening and evolving our cybersecurity program.”

Earlier this month, the FCC said AT&T had agreed to pay $13 million to settle an investigation into a data breach at a cloud provider in January 2023 that affected 8.9 million AT&T wireless customers.

AT&T disclosed in July a separate massive hacking incident in April that resulted in the illegal downloading of approximately 109 million customer accounts and is currently under investigation by the FCC.

In July, the FCC said Verizon's TracFone Wireless had agreed to pay $16 million over data breaches and implement reforms.

(Reporting by David Shepardson; Editing by Leslie Adler and Edward Tobin)