Data breaches cost T-Mobile $31.5M

Another major data security settlement from the FCC Enforcement Bureau Privacy Team: https://lnkd.in/eZghXyxT Today’s Consent Decree with T-Mobile requires the company to not only pay a nearly $16 million civil penalty (and dedicate an equal amount to future cybersecurity investments), but also to implement a variety of safeguards that will help protect customers’ data going forward.?Among other commitments, T-Mobile has agreed to: - Designate a CISO who will report regularly to the Board of Directors on cybersecurity matters; - Use phishing-resistant multifactor authentication (MFA) to secure its systems; - Move towards a “Zero Trust” security framework; - Adopt data minimization, data inventory, and data disposal processes to limit the personal information it collects and maintains; and - Undergo independent third-party security assessments. Very pleased to be part of the team that is carrying out this important work on behalf of the American public!

This is a textbook example of why #Cybersecurity, #InformationSecurity, and #DataPrivacy in US regulated businesses continue to fall short. Despite years of security failures, T-Mobile USA’s "penalty" boils down to a token fine and an obligatory investment in their own security posture; essentially, a slap on the wrist. H/t to the IAPP's "Daily Dashboard" for highlighting this ruling. ? A subsidiary of a global company that has seen five major incidents and breaches since 2020, potentially impacting nearly every customer, is fined a paltry ~$16M and ordered to spend the equivalent amount on their own program. Where’s the incentive for actual improvement? ? What's even more frustrating is that we, the paying customers, are left with little to no recourse. Sure, we can switch providers, but the damage is already done. Multiple times over. Had the FCC required T-Mobile USA to compensate each and every affected customer, now that might have sent a tangible and memorable message. ? But alas, wishful thinking... ? https://lnkd.in/gyKDst4g

T-Mobile has reached a $31.5 million settlement to resolve a probe by the Federal Communications Commission into significant data breaches over three years that impacted tens of millions of U.S. consumers, the agency said on Monday. The No. 3 U.S. wireless carrier will pay a $15.75 million civil penalty and has agreed to spend another $15.75 million over two years to strengthen its cybersecurity program. The FCC said T-Mobile suffered data breaches in 2021, 2022 and 2023 that impacted millions of current, former or prospective T-Mobile customers. The FCC has taken an increasingly hardline on data breaches involving wireless companies and reached settlements that have also required significant cybersecurity improvements. https://lnkd.in/emtHCtEg

$31.5 Million in fines for compromising millions of U.S. consumers 3 years in a row. T-Mobile's revenue in Q2 was 19.77 Billion with net income at 2.92 Billion. This isn't even a flick on the wrist, let alone a slap. https://lnkd.in/eN4U-wpj

Great article. It’s concerning how many companies do not take cybersecurity seriously. T-Mobile specifically has had multiple breaches over the last several years but refuses to do anything about it. It costs a company $4.5M on average if they suffer a data breach, not including potential fines.

It was a busy but very productive few months for the FCC’s privacy work. Have been beyond lucky to work on advancing consumer privacy with such amazing people in the Telecommunications Consumers Division! https://lnkd.in/e7KpYrCP https://lnkd.in/ed33Mhwm

The $31.5M fine against T-Mobile by the FCC highlights the critical need for strong cybersecurity practices. The series of data breaches from 2021 to 2023 exposed millions of customer records, including sensitive information like Social Security numbers and addresses. In response, the FCC is requiring T-Mobile to adopt Zero Trust architectures and implement multi-factor authentication (MFA). This incident serves as a clear reminder that failing to prioritize cybersecurity can result in significant financial and reputational damage. In my latest blog post, I emphasize the importance of embedding Identity and Access Management (IAM) into digital transformation strategies. Secure cloud migration, unified identity systems, and strategic IAM frameworks—like Zero Trust and MFA—are key to ensuring that businesses stay protected while driving innovation. Waiting for a breach to overhaul your cybersecurity posture is a risky move. Now is the time to act, reassess your IAM strategy, and secure your digital initiatives. Brian Krebs Steve Morgan Sean Lyngaas Zack Whittaker Jamie Tarabay James Rundle Lily Hay Newman Dan Gooding Tim Starks Kim Nash Thoughts? ?? in comments #CyberSecurity #IAM #ZeroTrust #MFA #DigitalTransformation #CIO #CISO #DataProtection