Anatomy of a Breach

Anatomy of a Breach: T-Mobile US — 2 Million Customer Records Exposed Through an API Vulnerability

> series: anatomy_of_a_breach —— part: 116 —— target: t-mobile_us —— records: 2,000,000 —— method: api_vulnerability<span class="cursor-blink">_</span>_

Hedgehog Security 31 August 2018 11 min read

2 million customers. Another API vulnerability. Another T-Mobile breach.

On 24 August 2018, T-Mobile US disclosed that hackers had exploited an API vulnerability to access the personal data of approximately 2 million customers. The stolen data included names, email addresses, phone numbers, billing zip codes, and account numbers — though T-Mobile stated that no passwords, financial data, or Social Security numbers were compromised.

The breach was notable for two reasons: first, it was the latest in a series of T-Mobile security incidents documented throughout this series — following the T-Mobile UK insider breach of 2009 (Breach #007). Second, it was yet another API vulnerability — joining Moonpig (zero authentication), Snapchat (enumeration), and the AT&T iPad breach (IDOR) in the growing catalogue of API security failures that have appeared throughout this series. Our API penetration testing addresses exactly this vulnerability class.


Recommended

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

From AT&T in 2010 to T-Mobile in 2018 — APIs remain under-tested.

API Vulnerabilities Persist
From <a href="/blog/anatomy-of-a-breach-att-ipad-email">AT&T iPad</a> (2010) through <a href="/blog/anatomy-of-a-breach-snapchat">Snapchat</a> (2014), <a href="/blog/anatomy-of-a-breach-moonpig">Moonpig</a> (2015), and now T-Mobile (2018), API vulnerabilities have appeared in every era of this series. The OWASP API Security Top 10 exists because APIs are consistently under-tested relative to traditional web applications. Our <a href="/penetration-testing/api">API penetration testing</a> addresses all Top 10 categories.
Mobile Apps Depend on APIs
Modern mobile applications — including T-Mobile's customer app — communicate with backend systems through APIs. Every mobile app is an API client, and every API is a potential attack surface. Our <a href="/penetration-testing/mobile-application">mobile application testing</a> assesses both the app and its API communications.
Telecoms: Repeated Failures
T-Mobile's 2018 API breach, combined with the <a href="/blog/anatomy-of-a-breach-t-mobile-uk-insider">2009 UK insider breach</a> and <a href="/blog/anatomy-of-a-breach-vodafone-germany-insider">Vodafone Germany insider</a> (2013), demonstrates that telecoms companies — with their vast customer databases and numerous access channels — face persistent security challenges. <a href="https://www.socinabox.co.uk">SOC in a Box</a> monitors for API abuse patterns.
GDPR Context
The T-Mobile US breach occurred three months after GDPR came into force. While T-Mobile US was not directly subject to GDPR, the breach affected European customers and reinforced the global importance of API security in the GDPR era. <a href="/cyber-essentials">Cyber Essentials</a> addresses application security baseline controls.

Test your APIs. Every year. Every release.

The T-Mobile API breach — the latest in a decade-long series of API security failures documented in this series — reinforces that API testing must be a routine component of every organisation's security programme. APIs change frequently, new endpoints are added with every release, and each new endpoint is a potential vulnerability. API penetration testing must be conducted regularly — not just at launch, but with every significant change to the API surface.

Our API testing covers authentication, authorisation, rate limiting, input validation, data exposure, and business logic flaws. Cyber Essentials mandates baseline application security. SOC in a Box monitors for API abuse. And UK Cyber Defence provides incident response when API vulnerabilities are exploited.


API breaches: 2010, 2014, 2015, 2018. The pattern has not changed. Have your APIs been tested this year?

Our <a href="/penetration-testing/api">API penetration testing</a> covers the OWASP API Security Top 10. <a href="/cyber-essentials">Cyber Essentials</a> mandates baseline controls. <a href="https://www.socinabox.co.uk">SOC in a Box</a> monitors for API abuse.

Next Step

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Related Articles