In November 2015, security researchers Eric Taylor and Blake Welsh identified a vulnerability in MetroPCS’s online payment system. Anyone who knew a customer’s phone number could reportedly access sensitive account information, including the subscriber’s home address, phone model and serial number, and billing plan. The researchers reported the flaw to MetroPCS, which subsequently patched the payment portal. The incident demonstrated that a basic customer identifier could unlock data extending well beyond billing information.
The privacy risk resurfaced on a larger scale in August 2021, when Metro by T-Mobile disclosed that customer information had been compromised in a wider cyberattack against T-Mobile. The company said data from as many as 52,000 current Metro accounts was exposed, while stating that Social Security numbers and financial details were not involved. The breach did not affect former Sprint Corporation Prepaid or Boost Mobile customers, according to T-Mobile. Together, the incidents left a documented record of weaknesses in customer-data protection, although the supplied source does not identify fines, lawsuits, or a separate regulatory enforcement action.
