T-Mobile US, Inc. (NASDAQ: TMUS) has agreed to settle a 2021 data breach by creating a non- settlement fund of $350 million to provide substantial relief to impacted customers and has also agreed to maintain an incremental spend commitment of at least $150 million for data security and related technology for 2022 and 2023 to improve its network and data security and address vulnerabilities that resulted in the Data Breach.

According to the underlying consumer complaint, sometime as early as March 2021, one or more cybercriminals exploited T-Mobile’s data security protocols and gained access to internal servers containing the personally identifiable information (“PII”) of millions of current, former, and prospective T-Mobile customers (the “Data Breach”). After stealing 106 GB of this data, the hacker or hackers offered to sell a subset of the stolen PII via a dark-web forum. On August 16, 2021, T-Mobile announced the cyberattack, stating (at the time) that account data for more than 50 million current, former, or prospective customers was compromised in the Data Breach. T-Mobile also disclosed that an unidentified number of phone numbers, IMEI, and IMSI numbers were compromised. In November 2021, T-Mobile revealed in an SEC filing that its “investigation also identified approximately 26.0 million additional individuals” whose “names, dates of birth and, in many cases, addresses” were compromised, increasing the total number of individuals whose PII was compromised in the Data Breach to approximately 76.6 million.

T-Mobile had assured the market through its Privacy Policy that T-Mobile uses “administrative, technical, contractual, and physical safeguards designed to protect your data while it is under our control.” Its Privacy Center likewise assured the market that “[w]ith T‐Mobile, you don’t have to worry,” “[w]e’ve got your back,” and “you can trust us to do the right thing with your data.” But, as T-Mobile later admitted, it completely failed to meet these obligations and instead, suffered one of the largest and most consequential data breaches in U.S. history.

If you have continuously held T-Mobile shares since on or around its March 1, 2021 you may be able to seek corporate reforms, the return of funds back to company coffers, and potentially a court approved incentive award if appropriate.

If you would like to learn more about this matter at no cost to you, please us at jgrabar@grabarlaw.com or call 267-507-6085.