Connect with us

Hi, what are you looking for?



T-Mobile Hack Involved Exposed Router, Specialized Tools and Brute Force Attacks

American Living in Turkey Takes Credit for T-Mobile Hack 

American Living in Turkey Takes Credit for T-Mobile Hack 

T-Mobile’s CEO and an individual who claims to be behind the recent hacking of the mobile carrier’s systems have shared some information about how the attack was carried out.

In a statement issued on Friday, Mike Sievert, CEO of T-Mobile, said that while the company’s investigation into the incident was “substantially complete,” he could not share too many technical details due to the criminal investigation conducted by law enforcement. He did, however, share a high-level summary of the attack.

“What we can share is that, in simplest terms, the bad actor leveraged their knowledge of technical systems, along with specialized tools and capabilities, to gain access to our testing environments and then used brute force attacks and other methods to make their way into other IT servers that included customer data,” he said. “In short, this individual’s intent was to break in and steal data, and they succeeded.”

The Wall Street Journal reported last week that a 21-year-old man named John Binns, a US citizen living in Turkey, has taken credit for the attack, a claim that he demonstrated to the news outlet by sending messages from a Telegram account that had been used to discuss details of the breach before it became widely known.

Binns told the WSJ that he managed to infiltrate T-Mobile’s systems after identifying a vulnerable, internet-exposed router in July. He allegedly found the router using a simple, publicly-available tool. Some have speculated that this tool was likely Shodan, Nmap or Masscan.

He claimed that the router provided an entry point to T-Mobile servers in a data center near East Wenatchee, Washington, from where he obtained credentials that gave him access to more than 100 servers. Binns, who described T-Mobile’s security as “terrible,” claimed it took him roughly a week to breach the servers storing customer data.

The man said he carried out the attack to get attention. Last year, he filed a lawsuit against the CIA, FBI and other US government agencies, claiming that he had been blackmailed, surveilled and tortured.

Advertisement. Scroll to continue reading.

Some cybersecurity experts have linked the online accounts used by Binns to gamers who infected devices around the world with malware in an effort to create botnets.

The T-Mobile breach came to light earlier this month, when someone offered to sell 100 million customer records on the dark web for roughly $280,000 in bitcoin. However, it’s unclear if or how much of the data was acquired by others.

T-Mobile has confirmed that the breach impacts more than 54 million current, former and prospective customers. Compromised data includes names, dates of birth, phone numbers, addresses, SSNs, driver’s license information, IMEI and IMSI information, and account PINs. The company highlighted on several occasions, including in Sievert’s statement on Friday, that customer financial information has not been exposed.

Sievert has apologized to customers for the incident and the company is offering impacted individuals two years of free identity protection services. The company has also promised to take steps to prevent these types of incidents in the future.

However, T-Mobile has disclosed several data breaches over the past years and it doesn’t seem to have learned from those incidents, something that has been mentioned in the lawsuits filed against the carrier as a result of the latest breach.

Related: T-Mobile Outage Mistaken for Massive DDoS Attack on U.S.

Related: T-Mobile Data Breach Hits Over 2 Million Customers

Related: Hackers Accessed Information of T-Mobile Prepaid Customers

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Gain valuable insights from industry professionals who will help guide you through the intricacies of industrial cybersecurity.


Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.


Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.

CISO Strategy

SecurityWeek spoke with more than 300 cybersecurity experts to see what is bubbling beneath the surface, and examine how those evolving threats will present...


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.

CISO Conversations

Joanna Burkey, CISO at HP, and Kevin Cross, CISO at Dell, discuss how the role of a CISO is different for a multinational corporation...