> Still, the biggest issue here is how this person (or multiple people) obtained the employee phone numbers. We’re not sure yet which employees are impacted, but based on comments online it seems at least a few third-party employees are affected, and we’ve independently confirmed current corporate employees have also received the message.
Sadly, the idea that phone numbers of people are private should be considered laughable at this point. There is LinkedIn, and even if you're not directly connected to someone it would be easy to correlate publicly available LinkedIn data to phone number data.
Also, note that TMobile explicitly provides a "SIM Protection" feature, https://www.t-mobile.com/support/plans-features/sim-protecti.... Why this isn't enabled for everyone by default I don't know.