T-Mobile: Leaky API Exposes Data on 37 Million

T-Mobile disclosed that a threat actor exploited a vulnerable customer-facing API to access personal data for about 37 million customers (names, addresses, emails, phone numbers, dates of birth, account numbers and plan information) beginning around November 25, 2022 and discovered on January 5, 2023; the company states its network and customer financial data were not compromised and it has notified authorities and affected customers.