- A threat actor on the dark web is alleged to sell 52 million T-Mobile and 20 million Sprint customer records for approximately $250,000, with sample data including names, phone numbers, emails, birth dates, and account details.
- Telecom data enables SIM swapping, account takeovers, identity fraud, and crypto theft. Phone numbers serve as the master key to modern digital identity verification systems.
- Security experts urge users to move away from SMS-only authentication and add carrier PIN protection, while providers must strengthen SIM swap controls and fraud monitoring systems.
A threat actor on underground forums is advertising an alleged customer database combining records from both T-Mobile and Sprint. The seller claims the dataset contains approximately 52 million T-Mobile records and 20 million Sprint records, with significant overlap between the two sets.
The seller placed a price of $250,000 for this combined data file. The sample data in the advertisement includes mobile phone numbers, email addresses, full names, date of birth, physical addresses, carrier and account metadata, account types and subtypes, account numbers, and line counts.
Security researchers warn that telecom datasets rank among the most valuable dangerous categories in underground markets. Phone numbers have effectively become the master key to modern digital identity, this makes such type of data highly valuable to criminals.
Banking data is equally valuable. A separate dark web listing offers 2.3 million Brazilian bank records, showing that both telecom and financial data are prized by cybercriminals.
Telecom Data Enables SIM Swapping and Account Takeovers
Once attackers obtain telecom-related information, they can launch several types of damaging attacks – these include SIM swapping, where criminals transfer a victim’s phone number to their own device. They can also intercept multi-factor authentication codes sent via text message.
Account takeover attacks become much easier when criminals possess phone numbers, names, and birth dates. Identity fraud schemes can use this information to open new accounts or access existing ones. Crypto theft and financial account recovery abuse also become possible with telecom customer data.
Social engineering campaigns targeting both individuals and businesses can use the stolen information to appear legitimate. The underground market now effectively offers what researchers call “carrier bundle deals,” packaging data from multiple providers together.
The reference to overlapping T-Mobile and Sprint records holds particular interest for security analysts. Sprint’s legacy infrastructure and older data still appear valuable to threat actors, even years after the merger with T-Mobile.
Historical Breach Data Remains Operational for Years
Historical merger-related datasets are often fragmented across different systems. This fragmentation creates opportunities for attackers to piece together complete customer profiles from multiple sources. Older user information continues circulating underground for many years after the original breaches occurred.
Even when databases become several years old, they are still very operational and relevant for attackers. Most users don’t change their phone numbers, making older contact information still valid. Dates of birth and physical addresses also tend to remain static over long periods.
Telecom data helps criminals enrich other leaked datasets they may already possess. Combining information from multiple breaches creates more complete victim profiles. These enriched profiles increase the success rate of follow-on attacks.
Organizations that rely heavily on SMS-based authentication should view this development as another warning sign. Text message identity verification grows increasingly fragile as more telecom data circulates on dark web markets.
Users Should Move Away from SMS-Only Authentication
Experts believe that moving away from SMS-only authentication is best and that adding a PIN to the account is a way to help protect against SIM Swaps. Users should also look out for any signal loss or other odds on their SIM because it could indicate that someone is attempting to swap their SIM card.
Looking for activity on all accounts linked to mobile phone numbers will help with early detection of unauthorized activity. Users should be aware of any potential telecom-related phishing attempts that help to provide additional information to attackers. Also, attackers often utilize information from stolen customers to create fake messages which seem credible.
Telecom companies also need to improve their existing provisions for protecting against SIM Swaps and for verifying identity. A better fraud monitoring system would help find unusual account activity in a faster manner. Insider threat controls and legacy data retention governance also require ongoing attention.
The claims against T-Mobile and Sprint are currently unproven. Security experts advise treating the advertisement as alleged until there has been independent verification of the data, if the information is new or older.
