T-Mobile has reached a settlement with the Federal Communications Commission (FCC), agreeing to pay a $15.75 million fine in response to a series of data breaches spanning three years. These breaches have affected millions of customers, exposing sensitive information such as names, addresses, dates of birth, Social Security numbers, and driver’s license numbers. The settlement also stipulates that T-Mobile must enhance its cybersecurity measures.
\n
The FCC’s order approving the consent decree outlines that T-Mobile experienced breaches in 2021, 2022, and 2023. These incidents impacted not only current and former T-Mobile customers but also end-user customers of wireless service resellers operating on T-Mobile’s network, commonly known as mobile virtual network operators (MVNOs).
\n
The FCC’s investigation into T-Mobile was prompted by several potential violations, including the company’s alleged failure to secure the confidentiality of private information and unauthorized disclosures. Furthermore, the FCC claimed that T-Mobile failed to take adequate measures against unauthorized access attempts and used unjust practices in its information security strategy.
\n
As part of the settlement, T-Mobile pledges to invest an equal amount of $15.75 million over the next two years to bolster its cybersecurity program. The funds will also support the development and implementation of a compliance plan to safeguard against future breaches. The fine will be allocated to the U.S. Treasury.
\n
In an official press release, the FCC highlighted the significance of the settlement, referring to it as a “model for the mobile telecommunications industry.” According to the FCC, the security improvements T-Mobile agrees to undertake “will likely require expenditures an order of magnitude greater than the civil penalty.” These enhancements are set to include addressing foundational security flaws and integrating advanced security measures, such as zero trust architectures and phishing-resistant multifactor authentication.
\n
T-Mobile’s financial standing remains robust despite the fine, with the company reporting $19.8 billion in revenue and $2.9 billion in net income in Q2 2024. However, the stipulated cybersecurity investments highlight the increasing costs associated with data protection in today’s digital landscape.
\n
The FCC settlement reflects growing regulatory scrutiny over telecommunications companies’ data privacy practices, sending a “strong message” to carriers about the imperative of ensuring robust customer data protection.