T-Mobile Data Breach 2021: What Was Exposed and What to Do
The 2021 T-Mobile attack exposed Social Security numbers and ID details for tens of millions of people, including many who were never customers.
By Siddharth ShankarUpdated October 18, 2026In August 2021, T-Mobile said a cyberattack exposed names, dates of birth, Social Security numbers and driver’s licence details of about 7.8 million current postpaid customers and about 40 million former or prospective customers, plus other data for millions more. A class action settlement of $350 million followed. Because SSNs and dates of birth do not change, freeze your credit, get an IRS IP PIN and protect your phone account from SIM swaps.
Your email may already be in a known data breach. Find out in about 30 seconds.
Free · About 30 seconds · No sign-up · Email not stored
The 2021 T-Mobile breach stood out because it reached people who had only applied for credit with T-Mobile, not just customers. Many people learned they were affected without ever having had a T-Mobile phone.
What T-Mobile said was exposed
In its August 2021 update, T-Mobile reported:
- About 7.8 million current postpaid customer accounts: names, dates of birth, Social Security numbers and driver’s licence or ID information. T-Mobile later added phone numbers, IMEI and IMSI numbers.
- About 40 million former or prospective customers: names, dates of birth, SSNs and driver’s licence or ID information.
- About 5.3 million more postpaid accounts: names, addresses, dates of birth, phone numbers, IMEIs and IMSIs, without SSNs or licence data.
- About 850,000 prepaid accounts: names, phone numbers and account PINs, which T-Mobile said it reset.
T-Mobile said it had no indication that card or other payment information was taken. It offered two years of free identity theft protection, scam-blocking for eligible customers and Account Takeover Protection for postpaid accounts.
Do not guess. See which breaches include your email and what leaked.
Free · About 30 seconds · No sign-up · Email not stored
The settlement
In July 2022, T-Mobile agreed to a $350 million class action settlement and to spend an extra $150 million on data security, according to Fox Business. Class members could receive cash payments, reimbursement of losses and identity protection. The claim period has closed.
What to do now
1Lock new credit in your name
Your SSN and birth date from 2021 still work for criminals today. Placing a credit freeze with Equifax, Experian and TransUnion is free and blocks new accounts.
2Block fake tax returns
Ask the IRS for an Identity Protection PIN so nobody can file using your SSN.
3Harden your phone account
IMSI and PIN data in this breach are useful for SIM swap attempts. Set a new account PIN and turn on any number-transfer lock your carrier offers. Background in our SIM swap statistics.
4Treat unexpected calls with suspicion
Callers who know your name and birthday are not proof of anything. See what to do when your number is in a breach.
5Review your credit file often
All three bureaus offer free weekly reports at AnnualCreditReport.com. Look for accounts or addresses you do not recognise.
How the attacker got in
T-Mobile’s chief executive said the attacker first reached its testing environments, then used brute force attacks and other methods to get into servers holding customer data. The lesson for customers is that you cannot control a company’s security, but you can limit what a leak lets criminals do with your details.
Were prepaid customers affected?
Yes, but differently. T-Mobile said about 850,000 prepaid accounts had names, phone numbers and account PINs exposed, and that it reset those PINs. If you were a prepaid customer, check that your account PIN is one you set yourself, not an old one.
How to know if you were notified
T-Mobile said it was contacting affected customers. If you were a customer or applied for credit with T-Mobile before 2021, assume your details may have been included and take the protective steps anyway. They cost nothing and protect you from other breaches too.
Why an old breach still matters
Breaches from years ago keep circulating and get combined with newer leaks. See should you worry about an old data breach and what to do if your SSN was leaked.
Sources
- T-Mobile Newsroom: Updated information on the 2021 cyberattack (numbers affected, data types, PIN resets, protections offered)
- Fox Business: T-Mobile settles suit over hacking for $350M (July 2022) (settlement amount, $150M security spending)
- T-Mobile Newsroom: The cyberattack against T-Mobile and our customers (how the attacker got in)
Frequently asked questions
How many people were affected by the T-Mobile 2021 breach?
T-Mobile reported about 7.8 million current postpaid accounts and about 40 million former or prospective customers with SSNs exposed, plus millions more with other data.
Was I affected if I never had T-Mobile?
Possibly. Former and prospective customers who applied for credit were included.
Were credit card numbers stolen?
T-Mobile said it had no indication that payment information was in the stolen data.
Can I still claim from the settlement?
The claim period for the 2022 settlement has closed.
What is the most important step now?
Freeze your credit at all three bureaus, because SSNs and dates of birth do not change.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Change reused and leaked passwords
NordPass flags weak and reused passwords, and its Premium plan alerts you if your details appear in new breaches.
See NordPass →Affiliate link. We may earn a commission at no extra cost to you.
Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.