T-MOBILE US INC

T-Mobile has a documented pattern of massive data breaches spanning 2021-2023, demonstrating systemic failures in data security governance. In August 2021, attackers stole records of 47.8 million customers including SSNs, driver's license numbers, and dates of birth, resulting in a $350 million class action settlement (approved June 2023) plus $150 million in mandatory security investments. In 2022, another breach via SIM-swapping and phishing compromised internal systems. In January 2023, a misconfigured API exposed personal data for 37 million current customers. The FCC settled in September 2024 for $31.5 million ($15.75M penalty + $15.75M security investment) covering all three breaches, finding the attacks were "varied in their nature, exploitations, and apparent methods of attack" — indicating not isolated incidents but recurring governance failures. Washington State AG filed a separate lawsuit over the 2021 breach. T-Mobile was required to adopt zero trust architecture and phishing-resistant MFA, confirming the company's prior security posture was materially deficient.