Trump Mobile leaks data of Donald Trump staffers

What it is

A data breach disclosure involving Trump Mobile, a mobile carrier brand owned by T1 Mobile (licensed from the Trump Organization) and operated on the backend by Liberty Mobile. Ransomware/extortion group BYOD published the leaked data on its leak site; cybersecurity outlet International Cyber Digest (ICD) claims to have spoken directly with the attacker about the intrusion method.

How it works

Per the attacker's account to ICD, initial access was gained by deploying an infostealer against an employee at Liberty Mobile — the company that manages T1 Mobile's backend infrastructure. This is a credential/session-theft foothold rather than a direct exploit of Trump Mobile systems, meaning the attack surface was a third-party vendor employee, not Trump Mobile itself.

Preconditions / Affected

The attacker claims neither Liberty Mobile nor T1 Mobile used multi-factor authentication, and neither maintained a security team or incident-response capability (internal or third-party). Trump Mobile reportedly has roughly 600,000 total customers, but the leaked dataset covers only ~3,615 of them — the article notes it's unclear why the breach was limited to this subset rather than the full customer base.

What to do

The page reports no remediation or patching action taken by Trump Mobile/Liberty Mobile. When BYOD first contacted the company about the breach, the reported response was "We have no team to handle this," and that the company characterized the hackers as "terrorists" rather than engaging on remediation. No official statement, disclosure timeline, or customer notification process is described in the source.

Caveats

The intrusion vector (infostealer against a Liberty Mobile employee) and the absence of MFA/security team are both attacker claims relayed through ICD, not confirmed by Trump Mobile, Liberty Mobile, or an independent forensic source. The reason only 3,615 of ~600,000 customers were affected is explicitly stated as unknown.