About 3% of T-Mobile customers, or 2 million, were impacted in a recent breach with the unauthorized access of their names, zip codes, phone numbers, account numbers, account types, and email addresses. Someone decided to help him or herself into the company’s network. This occurred on August 20 when the company’s cybersecurity team shut down an unauthorized intruder.
Originally, T-Mobile declared that passwords were not part of this. However, in an update with Motherboard, a spokesperson for T-Mobile stated that “encrypted” passwords were included, presumably assuming that if it’s encrypted, it is safe. The spokesperson also declined to say how the passwords were encrypted. However, depending on what type of encryption was used, it is possible to crack encrypted passwords.
It’s always a good idea to change your password when a data breach of your information occurs, regardless of whether or not passwords were accessed or how they may have been encrypted. Getting into the habit of changing all passwords on a regular basis is recommended. Perhaps at the beginning of every year is a good idea, like when changing out your smoke detector batteries.
In addition, be on the lookout for targeted phishing email messages. Whenever your email address is retrieved as part of a breach, watch for incoming email messages related to whichever organization it was that experienced the incident. Cybercriminals will not only send out spam emails in a generic fashion to thousands or millions of email addresses, but if they know something about those people whose addresses they chose, such as what wireless carrier they use, they will get more specific. They may greet you by name, use real logos, or detailed language to try to fool you into thinking they are legitimate.
Customers who were specifically affected were notified via text message. While those texts may be legitimate, since these thieves also have your mobile phone number, they could also try to phish you using text or SMS.
Don’t fall for it. If you don’t request a link or attachment, are not expecting it, or aren’t quite sure where it will take you if you click it, just don’t click it. Often, these targeted phishing attacks will ask you to verify your account data, pay an attached invoice, or claim your account is locked and in order to unlock it, you must click a link. Instead of doing that, go directly into your account on the website or in the app and verify information there. If ever in doubt, contact the sender directly by phone. And don’t use a number in the email in question. Find that number from the actual website or another place you know to be real.
Phishers are savvy these days. They will go to great lengths to get useful information out of us. Just use caution all the time. Take a moment to consider what is in the message and how to respond and you can avoid being caught in the phishers’ nets.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
