Skip to main content

T-Mobile website bug reportedly exposed private customer account details

t-mobile
Image used with permission by copyright holder

Due to a bug in T-Mobile’s website back in April, customers’ account information was left accessible for anyone to see, ZDnet reports. While the security flaw has since been fixed, personal information could have potentially been misused by anyone who knew where to look.

The subdomain — promotool.t-mobile.com — is a customer care portal for employees to access internal tools. But the bug allowed for it to be easily found through search engines and didn’t require a password to access the tools.

The flaw was due to a hidden API — it provided T-Mobile customer data by adding the customer’s cell phone number to the end of the web address. This data included a customer’s billing account number, postal address, and account information, such as the status of their bills, including if service for an account was suspended or a bill is past due. For some, customer account PINs and tax ID numbers were also accessible.

The API was pulled by T-Mobile a day after it was reported by security researcher Ryan Stevenson, who was also awarded a $1,000 bug bounty later. While it’s not clear how long the API was exposed, a spokesperson for T-Mobile told ZDnet that there’s no evidence any customer information was accessed.

This is isn’t the first time an issue like this has happened to T-Mobile. In October, a security flaw allowed hackers to gain access to similar information through a T-Mobile website. Hackers were able to obtain email addresses, account numbers, and more, simply by using the customer’s phone number.

The flaw was discovered by security researcher Karan Saini, and it allowed hackers to gain information that could then be used in a social engineering attack, as well as provided access to other personal information online. T-Mobile claimed the bug only affected a small amount of customers and that it was fixed within 24 hours of being discovered.

News of the most recent flaw comes a little less than a month after the merger with T-Mobile and Sprint was announced — which was also in April. While both carriers agreed on combining companies, we have yet to see whether the U.S. Justice Department will approve it.

Brenda Stolyar
Former Digital Trends Contributor
Brenda became obsessed with technology after receiving her first Dell computer from her grandpa in the second grade. While…
T-Mobile still has the fastest 5G, but its rivals are catching up
T-Mobile smartphone.

For most of 2023, we’ve seen median 5G speeds among the big three carriers remain fairly stable, leading us to believe that things were beginning to reach a plateau. However, it now seems that this may only be true at the very top end of the 5G speed race.

Today, Ookla released its latest market research on 5G speeds for the third quarter of 2023, and it’s an interesting mix of surprising and not-so-surprising developments in the 5G market.

Read more
T-Mobile’s huge lead in 5G speeds isn’t going anywhere
OnePlus Nord N300 5G speed test.

It looks like 2023 could shape up to be the year that we reach "peak 5G." While T-Mobile still enjoys a very healthy lead over its rivals, we're no longer seeing significant speed increases from any of the big three U.S. carriers.

That's not surprising for T-Mobile and Verizon since they now cover more than two-thirds of the U.S. population. AT&T still has room to grow, yet it seems to be in a resting phase rather than an expansion one right now.

Read more
The 5G speed race is over and T-Mobile has won
Cell phone tower shooting off pink beams with a 5G logo next to it.

Every few months, a new market analysis comes out comparing the top 5G performance and availability among U.S. carriers. Each time, we wonder if the latest report will finally topple T-Mobile, which has held a commanding lead over rivals AT&T and Verizon for years. Yet, with each new report, T-Mobile pulls farther ahead while AT&T and Verizon are left in the dust.

With that in mind, Opensignal's latest 5G Experience Report doesn't bring too many surprises, at least in broad strokes. T-Mobile continues to deliver 5G download speeds that are more than twice those of any other carrier and more than twice the 5G availability. This means you won't just get faster performance on T-Mobile's 5G network, but you're more likely to be able to find a 5G connection.

Read more