15 Million T-Mobile Customers Personal Info Stolen

MIAMI (CBSMiami) - If you signed for cell phone service with T Mobile in the beginning of September, your personal information may be for sale.

T-Mobile uses Experian, one of the three major credit bureaus, to conduct credit checks on customers who applied for cell phone service. Experian, however, suffered a major data breach and hackers made off with the personal information of 15 million people who signed up for T-Mobile service between Sept. 1, 2013 and Sept. 16, 2015. Information taken included the customers' Social Security numbers, home addresses and birthdates.

Experian said it immediately notified law enforcement after discovering the hack and that "there is no evidence to date that the data has been used inappropriately."

T-Mobile customers can sign up for two free years of credit monitoring services at www.protectmyID.com, a service owned by Experian.

That arrangement prompted sarcastic responses on Twitter. T-Mobile CEO John Legere, who is active on Twitter, responded to many tweeters unhappy with the resolution offered.

"I hear you re: Experian as service protection option. I am moving as fast as possible to get an alternate option in place by tomorrow," Legere wrote Thursday evening.

Earlier in a statement, Legere had said that he was "incredibly angry" about the breach and that the company would review its relationship with Experian.

"Customers will be cynical" about using credit monitoring from Experian, said Gartner security analyst Avivah Litan. "Why would you trust someone with your accounts that's been breached."

Still, she said that customers can still use the service. But as an alternative, they could check their credit reports for free at www.annualcreditreport.com. The site lets consumers check each of their credit reports from the three credit rating agencies— Equifax, Experian and TransUnion — once a year.

The hack happened on Experian's server and is still being investigated, said Annie Garrigan, a spokeswoman for Bellevue, Washington-based T-Mobile.

Experian said in a statement on its website that it doesn't know who was behind the hack and that it is taking "necessary steps" to prevent further breaches.

The company said that affected customers should "remain vigilant" against identity theft and watch for phishing email scams that ask for sensitive information such as bank account and Social Security numbers.

The companies said that payment card and banking information was not affected, but consumers shouldn't downplay the theft of Social Security numbers, said Eva Velasquez, the CEO of the nonprofit Identity Theft Resource Center.

"There are many more steps you have to take to minimize your risk when your Social Security number is compromised versus payment card data," she said.

Payment cards can be canceled, ending the harm. But thieves can use someone's Social Security number to open new financial accounts and take out new loans for big-ticket items like cars and they can file a false tax return in your name.

Velasquez said that affected consumers should review their credit reports and sign up for a credit monitoring service and think about putting fraud alerts on their credit reports. They should also file tax returns as soon as they can, to beat a potential thief.

There have been a string of high-profile hacks of businesses and other organizations in recent years affecting millions of people, including adultery website Ashley Madison, Sony Pictures, the insurer Anthem, retailers such as Home Depot and Target, eBay and the U.S. Office of Personnel Management.

Nearly 800 data breaches were reported last year by U.S. organizations, according to the Identity Theft Resource Center.

(TM and © Copyright 2015 CBS Radio Inc. and its relevant subsidiaries. CBS RADIO and EYE Logo TM and Copyright 2015 CBS Broadcasting Inc. Used under license. All Rights Reserved. This material may not be published, broadcast, rewritten, or redistributed. The Associated Press contributed to this report.)