Once again, there was a cyber incident at the telecommunications service provider T-Mobile. Criminal hackers have managed to penetrate the company network through stolen credentials and gain access to the operating software.
In our blog post, you will learn how the events happened and how companies can protect themselves.
What happened?
On 22.04.2022, T-Mobile confirmed that the criminal hacker group Lapsus$ penetrated the company’s network a few weeks ago with previously stolen credentials and was thus able to gain access to the company’s internal systems. Lapsus$ is known for stealing data from reputable companies and making ransom demands. The group is reportedly led by a teenage mastermind and has already been caught.
A spokesperson for the telecommunications company assured BleepingComputer that no sensitive information or customer data was stolen as part of the cyberattack. The cybercriminals only managed to access internal operating software, which is not related to confidential information. No evidence was found that data or trade secrets had been tapped.
The incident was uncovered by in-house monitoring tools that documented the intrusion of the unauthorized actors through stolen credentials. According to T-Mobile, the criminals’ access was quickly cut off, and the compromised credentials used were immediately deactivated. The company’s systems and processes have been cleaned up and are working as intended.
The cyber incident was brought to the fore by independent investigative journalist Brian Krebs, who was the first to report on the cyber incident. He was able to analyze leaked Telegram chat messages between members of the Lapsus$ gang and determine that the attackers had managed to steal internal source code from T-Mobile and then penetrate the systems.
What are the risks for my company?
According to T-Mobile, the criminal hacker group only had access to internal systems, but these were not related to sensitive data or even customer data. Sensitive information was not stolen and could therefore not be offered for sale on the darknet.
Therefore, it can be assumed that there is no immediate risk for T-Mobile customers – nevertheless, vigilance is required. As always:
