T-Mobile confirms stolen data is genuine

T-Mobile has confirmed that internal information posted on the Internet by hackers was stolen from its systems.


T-Mobile confirmed on Tuesday that internal information posted on the Internet by hackers was stolen from its systems, but said it does not appear customer data is in jeopardy.

Hackers posted a message on Saturday on the Full Disclosure vulnerability message board claiming they'd pilfered confidential documents as well as financial and database information from T-Mobile's servers. After trying to sell the data to T-Mobile's competitors, they wrote they were offering the information to the highest bidder.

However, T-Mobile disputes the value of the data. "Regarding the recent claim on a Web site, we've identified the document from which information was copied and believe possession of this alone is not enough to cause harm to our customers," the company said.

T-Mobile said further information could not be released due to the ongoing investigation. The company will contact customers if it becomes evident personal information was compromised, it said.

In the message on Full Disclosure, the hackers posted data showing information on operating system versions, applications and IP (Internet protocol) addresses allegedly collected from T-Mobile's systems. It revealed information on what kind of internal software systems the company uses, such as software from vendors including Tibco Software, SAP, Centivia and Teradata.

At least one data security specialist doubted the hackers obtained as much sensitive information as they claimed.

"If these guys have personally identifiable information, then they would have exposed enough of that to give credibility to the story, because it's going to massively increase the value of what they're going to sell," said Paul Davie, founder of data security specialist Secerno. "So I suspect that they don't have that kind of thing."

T-Mobile International is a wholly-owned subsidiary of Deutsche Telekom of Germany. In its first quarter 2009 financial results ending in March, the company counted 148.4 million customers in 12 countries.

In October last year, T-Mobile admitted it had lost control of data on about 17 million customers in a separate incident dating back to early 2006.

Silent about the data loss for more than two years, the company published its version of events following a report in German news magazine Der Spiegel that the data were being offered for sale on the net.

In 2006, T-Mobile was approached by a person claiming to have confidential customer data in his possession, said a company spokesman.

Data on the disk included customers' name, date of birth, address and mobile phone number, and in some cases the customers' e-mail addresses. No banking details were lost, he said.

T-Mobile said it had found no evidence in the months following the loss that the missing data was on the market.

(Robert McMillan and Peter Sayer contributed to this report.)

"Recommended For You"

HBOS bank apologises after loss of 62,000 customers' confidential data Missing HBOS bank customer data was not encrypted