Hacker News Reader

Comment by flanbiscuit | Hacker News Reader

> The information obtained for each customer varied but may have included full name, contact information, account number and associated phone numbers, T-Mobile account PIN, social security number, government ID, date of birth, balance due, internal codes that T-Mobile uses to service customer accounts (for example, rate plan and feature codes), and the number of lines

wow, pretty much everything. great. How have they not learned from the last SEVEN times?! Can they be sued for this? Can they be fined by the government for this?

I just logged in and when I tried going to my profile section I just got a screen that said "Access restricted". Maybe because I'm logging in from my work laptop which I've never done before. I guess this is how they are trying to deal with the issue, preventing access of sensitive info from "suspicious" logins.

View on HN

You can sue, but you'll need to wait until you suffer damages. And good luck proving that it was in fact THIS breach that caused your identity theft.

The system is broken. There is no accountability whatsoever. You have no power to change any of this. It's all fucked.

This would be a lot less problematic if we in the US wouldn't constantly use an ID as a authentication secret. Usage of social security numbers as a auth secret needs to be treated as a national emergency. Won't happen though because most our Congress people are geriatric and don't understand technology and the industry would push back on any change because it would cost then money.

I used to "half-joke" about wanting everyone's SSN published in one big fat breach. I don't joke about it now. I really do want every single SSN to be published somewhere with the associated identities. It seems like nothing short of that will convince banks and other sensitive institutions to give up on using it as a secret.

Then, once the SSN can't be plausibly relied upon to authenticate people, these industries will have to do the hard work themselves.

> I used to "half-joke" about wanting everyone's SSN published in one big fat breach. I don't joke about it now

The 2017 Equifax breach was 40+% of americans. As far as I can tell, it barely changed anything about using SSNs as username and password for identity and credit. It maybe helped end user fees for credit freezes. Based on the response to that breach, I don't think a full dump would change anything either. I don't know what it was like before this breach, but identity fraud doesn't seem to get any investigation these days --- a year or so, someone rented an Oakland luxury apartment and tried to open two credit cards in my spouse's name and social security number, and Oakland PD didn't follow up at all.

Yeah, but even that breach isn't a public thing. The contents of it, I mean. Like, I can't go to a site somewhere and just look up people's names and find out their socials.

That's what I'm hoping for. A full database dump of everybody's SSN that's made embarrassingly public, so people can see just how useless SSNs are. I could enter "Marvin Garrison, DOB 1974-04-20" and get Marvin's SSN.

A torrent file, made available for even a short period of time, would be preserved forever and put the final nail in the coffin.

I know this sounds like some nerd version of Fight Club, but I stand by it :)

But wouldn't that require a lot more personal information to be in the leak than just Name/SSN? At least DOB, and sometimes more would be required. Therefore that would be a huge and damaging leak that would encompass more than just SSNs. Be careful what you wish for.

Yeah, let's keep it to stuff that's already widely known. First, Last, DOB. That's it.

Sure, there will be duplicates. John Miller, born on 10/10/1963 will happen a dozen times maybe. Will still be effective in destroying the SSN as a magic key.

You don't have to prove damages, just negligence. T-Mobile has a fiduciary duty to protect your private details. The problem is you'll be lumped into to some class action suit and handed a payout for pennies on the dollar while the lawyers laugh all the way to the bank. If individuals started suing it would be an absolute nightmare for T-Mobile. I'd happily pay the 40 dollars for a small claims court fee, but thankfully I'm not a customer of this bozo operation.

I have proof they made an error on my name that they always refused to fix and I receive all kind of scams and attacks with those. Robinhood that has a different one has the exact same problem. But they are almost entirely crypto scams by email.

For some reason it seems only the U.S. division of T-Mobile is getting hacked, while the german one is rarely in the news...

"division" is not the right term for it. They are really different companies, even though the majority owner is the same and they use similar branding. T-Mobile US wasn't created by T-Mobile Germany expanding, but rather through Telekom buying US carriers and rebranding them, and thus they don't share infrastructure or corporate structures.

But its clear the german company? Division? Seems to take security much more seriously

Reply on news.ycombinator.com