US reaches $31.5 million settlement with T-Mobile over data breaches

(Reuters) — T-Mobile has reached a $31.5 million settlement to resolve a probe by the Federal Communications Commission into significant data breaches over three years that impacted tens of millions of U.S. consumers, the agency said Monday.

T-Mobile will pay a $15.75 million civil penalty and has agreed to spend another $15.75 million over two years to strengthen its cybersecurity program. The FCC said T-Mobile suffered data breaches in 2021, 2022 and 2023 that impacted millions of current, former or prospective T-Mobile customers.

The 2021 breach alone impacted 76.6 million U.S. consumers while a 2023 breach impacted 37 million, the FCC said.

The FCC said T-Mobile, the nation’s third-largest wireless carrier, with 119.7 million customers, will address “foundational security flaws, work to improve cyber hygiene, and adopt robust modern architectures, like zero trust and phishing-resistant multi-factor authentication.”

T-Mobile did not immediately respond to a request for comment.