How to protect your T-Mobile account in light of the latest data breach
In response to a breach that compromised the personal data of millions of subscribers, T-Mobile customers should change their password and PIN and set up two-step verification.
A cyberattack against T-Mobile has resulted in the theft and compromise of certain personal data of almost 50 million people. This week, the carrier acknowledged a major data breach in which cybercriminals obtained the first and last names, dates of birth, Social Security numbers (SSNs) and driver’s license/ID numbers of 7.8 million current T-Mobile postpaid customers and more than 40 million former or potential customers who applied for credit with the company. Also compromised were the names, phone numbers and account PINs of around 850,000 active T-Mobile prepaid customers.
SEE: Security Awareness and Training policy (TechRepublic Premium)
Responding to the breach, T-Mobile implemented a few measures, such as two years of free identity protection services with McAfee’s ID Theft Protection Service and Account Takeover Protection for postpaid customers. Further, the company has advised all postpaid subscribers to change their PIN, even though it said it wasn’t aware of any postpaid account PINs being compromised.
Much of data stolen by the attacker is reportedly already up for sale on the Dark Web. The breach came to light earlier this week upon news that T-Mobile was investigating an underground forum post from someone claiming to be selling customer data obtained from T-Mobile servers, according to tech news site Motherboard.
The data up for grabs included Social Security numbers, phone numbers, names, physical addresses, unique IMEI numbers and driver’s license numbers. Motherboard said it looked at samples of the data and confirmed that it contained details on T-Mobile customers.
Much of this data seems destined to end up in the hands of cybercriminals, who will use it for account compromises, identity theft and other illegal activities. That means now would be a good time for all T-Mobile users to take steps to protect and secure their account, including changing the password and PIN and setting up two-step verification. Here’s how to do just that.
Sign into the My T-Mobile website to access your account. At the account page, click on the My T-Mobile menu in the upper right and select My Profile. At the Manage profile page, click the first option for Profile information. Scroll down the Profile information page and click the Edit link in the Password section. Type your current password and then create, type and re-type a new password, trying to follow the usual guidelines for devising a strong and secure password. Click Save.
Next, click the Edit link in the PIN section. Type and then re-type a new numerical PIN, creating one with at least six digits. Click Save.
At this screen, you can also set up your security questions if you haven’t already done so or you wish to change them. Click the Edit link in the Security Questions section. Choose or change the first, second and third questions, providing an answer for each one. When done, click Save.
To set up two-step verification for your account, look for a section for Two-Step Verification Options. Your best bet here is to use an authentication app, and T-Mobile steers you to Google Authenticator. If you don’t already have this app, download it for your iPhone or Android phone. Back at the website, click the Set up link for Google Authenticator. At the next screen, click Get Started. The page should display a QR code.
Open the app on your phone. Tap the plus icon at the bottom of the screen and select the option for Scan a QR code. Scan the code on the webpage with your phone. Click the button to Continue setup. Enter the current six-digit code for your T-Mobile account as displayed in the app on your phone. Click the button to Confirm Code. Each time you sign into your account, T-Mobile will ask you to enter the current code from Google Authenticator.
Finally, you can further protect your account by requiring a password and additional verification method each time you sign in. To do this, turn on the switch for the option that says: “When this option is on, we’ll ask you to provide your password and a second verification method every time you log in.”
Cybersecurity Insider Newsletter
Strengthen your organization’s IT security defenses by keeping abreast of the latest cybersecurity news, solutions, and best practices. Delivered Tuesdays and Thursdays