\n<\/p>\n
Washington state is suing T-Mobile for allegedly failing to address cybersecurity vulnerabilities that enabled a hacker to expose the personal data of 79 million people nationwide. The consumer protection lawsuit filed<\/a> by Washington Attorney General Bob Ferguson on Monday stems from a cyberattack that began in March 2021 and went unnoticed until T-Mobile disclosed the breach in August<\/a>.<\/p>\n<\/div>\n The filing asserts that T-Mobile failed to address certain security vulnerabilities that the company was aware of \u201cfor years,\u201d and did not properly notify more than two million Washington residents who were impacted by the breach. The lawsuit accuses T-Mobile of downplaying the severity of the breach, which exposed the personal information of current, former, and prospective customers \u2014 including their names, phone numbers, physical addresses, dates of birth, Social Security numbers, and driver\u2019s license \/ ID numbers.<\/p>\n<\/div>\n The notifications that T-Mobile issued about the data breach violated the Consumer Protections Act by omitting key information that made it difficult for people to assess if they were at risk of identity theft or fraud, according to the filing. The lawsuit also says that T-Mobile \u201cdid not meet industry standards for cybersecurity\u201d for years prior to the hack, and used \u201cobvious passwords\u201d to protect accounts that could access consumer information.<\/p>\n<\/div>\n \u201cThis significant data breach was entirely avoidable,\u201d Ferguson said in a statement<\/a>. \u201cT-Mobile had years to fix key vulnerabilities in its cybersecurity systems \u2014 and it failed.\u201d<\/p>\n<\/div>\n This isn\u2019t the first time that Washington state has taken action against T-Mobile, with Ferguson having successfully persuaded<\/a> the company to make clear the limitations of its \u201cno-contract\u201d wireless service plan back in 2013.<\/p>\n<\/div>\n Ferguson\u2019s latest lawsuit is seeking compensation for customers impacted by the 2021 breach and a court order that would force T-Mobile to bring its cybersecurity practices in line with industry standards, alongside improving transparency and communication around future data breaches. This follows T-Mobile paying $350 million in 2022<\/a> to settle a class-action lawsuit stemming from the 2021 hack, and a further $15.75 million fine last year<\/a> over an FCC investigation into its repeated cybersecurity incidents.<\/p>\n<\/div>\n