T-Mobile breach exposed data of 40 million: How safe is your customers’ personal information?

Without a “defense in depth” security strategy you risk losing much more than customer data.

First reported by Vice’s Motherboard, the news of T-Mobile’s latest major data breach reached the feeds of concerned customers on Sunday the 15th. While perhaps not surprising to many, given the company’s recent history of intrusions, the dark details emerging from an underground forum lent this latest incident a particularly ominous edge.

According to Motherboard, the “seller,” who apparently had already been booted from the hacked servers, claimed to be looking for 6 bitcoin (roughly $270,000) for a “subset of the data containing 30 million Social Security numbers and driver licenses.” And for good measure, noted that the remaining data was already being privately sold on the dark web.

“We lost access to the backdoored servers”

“T-Mobile USA. Full customer info,” the seller stated, while acknowledging T-Mobile’s initial remediation efforts. “I think they already found out because we lost access to the backdoored servers,” said the intruder, who went on to claim that the data had already been downloaded and “backed up in multiple places.”

If this scenario sends chills down your spine – along with a twinge of job insecurity – you’re not alone.

Why the abysmal state of IT security readiness?

Despite increasingly urgent threat warnings from IT security experts, industry groups, and government agencies – including the FBI – many organizations remain curiously passive about implementing the comprehensive, robust defense security strategies required to neutralize this kind of criminal activity.

Certainly, many months of extreme Covid-related challenges have tested the limits of organizations’ staff, systems, processes, and infrastructures. Yet, unfortunately, the same stressors that have prompted some to make difficult changes (in the most difficult of times) may also have exposed critical vulnerabilities, which a growing army of malicious attackers is only too happy to exploit.

2020: The year of broken records

According to Forbes magazine, “the year 2020 broke all records when it came to data lost in breaches and sheer numbers of cyberattacks.” Forbes contributor and cybersecurity expert Chuck Brooks attributes the seemingly ever-increasing sophistication of these attacks to “the application of emerging technologies such as machine learning, artificial intelligence, and 5G, and especially from greater tactical cooperation among hacker groups and state actors.”

And so it goes, with no end in sight and potential targets expanding to include everyone from global Fortune 500 companies to critical supply chains, government agencies (including intelligence bureaus), financial institutions, healthcare providers, SMBs, and individual consumers.

So, where’s the disconnect? Hasn’t it become obvious that, since cybercriminal attacks continue to get increasingly sophisticated (and brazen), organizations must also strengthen their defensive security strategies?

Security at a crossroads: Making changes

As it turns out, while the current “state of readiness” for most organizations may best be described as alarmingly inadequate, according to one study, a resounding majority of IT security leaders fully acknowledges the urgency of the current threat and is actively directing resources to overcome its challenges.

A recent IDG survey, “Cybersecurity at a Crossroads: The Insight 2021 Report,” found that:

• Nearly 80% of IT leaders surveyed expressed a lack of confidence in their company’s security posture and saw room for improvement – despite a significant increase in IT security investments in 2020
• As a result, 91% of organizations plan to increase their cybersecurity budgets again in 2021
• And, fully 100% of survey respondents report that their boards and executive teams are more focused on their organization’s security posture than in the past

Safeguard customer data—and maintain trust—with a defense in depth security strategy

How confident are you that you can effectively safeguard your customers’ sensitive personal data? Data breaches like the one at T-Mobile are costly and disruptive at best – but not only due to financial and business productivity losses.

The success of your organization ultimately depends on the strength of your relationships with customers and clients. And since those relationships are based on trust, if you allow their sensitive personal identifiable information (PII) to be accessed by a bad actor – regardless of the reason – you lose that trust and may ultimately lose them as customers.

That’s why the best way to secure that data is to deploy multiple defensive measures. Leading IT security experts agree that since no one security control element is entirely infallible, the safest environments rely on a defense in depth security strategy that comprises a multi-layered security architecture including these key elements:

• Administrative controls: The people factor – including policies, procedures, training, awareness, strong passwords, and other hygiene measures
• Physical barriers: Keycards, access codes, door and workstation locks, biometric appliances, and more
• Perimeter security: Anti-virus and anti-malware programs, data loss prevention (DLP), firewalls, border routers, other network boundaries
• Network security: VoIP protection, proxy content filters, remote access, and wireless security
• Endpoint security: Automated identity governance, device firewalls, patch management, content security, anti-virus/anti-spyware, and host intrusion prevention
• Application security: User activity and database monitoring, dynamic app testing, application firewalls, and runtime app self-protection technology

Now’s the time to reduce risk with defense in depth security. Imprivata can help.

Learn more about creating the defense in depth security strategy you need to safeguard your data assets in these challenging times.

Get the ebook, Defense in Depth: How to Secure Your Organization from the Inside Out.