T-Mobile Hacked Again, Intelbroker’s Hidden Secrets

Yesterday, on June 19, a notorious cybercriminal known as Intelbroker made a post on the Breachforums hacker forum alleging that T-Mobile, a leading global telecommunications company, had been breached recently, resulting in the theft of sensitive data.

Intelbroker, who has previously targeted organizations such as DC Health Link, General Electric, HP Enterprise, Five Eyes, Europol, AMD, and Apple, claimed to possess and be selling source code, SQL files, images, TerRaform data, T-certificates, and Siloprograms programs from T-Mobile. The hacker provided screenshots showing administrative access to the Confluence server and internal Slack channels as proof of the breach.

In response to these allegations, T-Mobile promptly denied that their systems were compromised. The company stated that they are actively investigating the claims and suspect a potential issue with a third-party service provider. T-Mobile insisted that there was no evidence of customer data or source code leakage and refuted the hacker’s claims of unauthorized access to their infrastructure.

Speculation arose that the data provided by Intelbroker may be old screenshots of T-Mobile’s infrastructure stored on a third-party supplier’s servers, which were then stolen.

Intelbroker has recently announced multiple new breaches, suggesting that the data may have originated from a single source. Snowflake, a company previously targeted in a large-scale hack impacting 165 companies, is a potential candidate as this source.

Despite these developments, T-Mobile has faced previous investigations into data compromises. This incident marks the third such cyberattack in the past two years. In January 2023, the company reported a data breach affecting 37 million customers, while in May 2023, data from hundreds of customers was leaked over a month-long period starting in February of that year.