Tens of millions of T-Mobile customers were impacted by the data breach that hit the company last year. The company carved out a settlement to pay those who were affected, but affected customers wonder if the financial fine is high enough.
Names, birthdates and the all-important social security numbers were among the treasure trove of sensitive data inside wireless carrier T-Mobile's system, which was hacked last summer.
The company said at the time that about 76 million of its customers could be impacted. Some of those consumers expressed astonishment at the development, given the breach was not the first to hit the company in recent memory. It was breach number six since 2018.
T-Mobile customer Carolina Barrera of Chicago said the details of the newest hack were bad enough. The way the company handled it, she said, was even worse.
"Their letter said a 'very bad actor' hacked our system. That was a … ridiculous statement," Barrera told NBC 5 Responds. "They’re supposed to be, as the commercials say, one of the safest. I don’t think so."
In the months that followed the 2021 breach, multiple class-action lawsuits were filed. In July, the company announced its plans to settle the suits for a total cost of $500 million. Of that, $350 million is earmarked for affected customers.
The number sounds big, privacy advocates say, until you do the math.
Local
"Is this a win for victims of T-Mobile's data breach? Will this substantially impact them? Will this make them whole? I don't think so," Emory Roane of the Privacy Rights Clearinghouse told NBC 5 Responds.
After attorneys’ fees and other costs, customers can expect a grand total of $5 to $10 each.
Feeling out of the loop? We'll catch you up on the Chicago news you need to know. Sign up for the weekly> Chicago Catch-Up newsletter.
"For an $80 billion company that made $80 billion last year, $5 to $10 per person is not going to be significantly impactful," Roane said.
Other numbers surrounding the costs of a data breach are eye-popping, especially as it relates to the individual victims themselves.
The 2021 “Cost of a Databreach” report by cybersecurity leader IBM found the average cost to consumers who have their personally identifiable information stolen is $180 per record. And that price grows each year.
For its part, T-Mobile did not answer our specific questions but said in a previous statement that, like every company, it is not immune to these criminal attacks. T-Mobile said in addition to the customer payouts, it has since "doubled down" on its extensive cybersecurity program.
Some say even that promise falls flat.
"$150 million of this $500 million settlement is going right back to T Mobile, where as part of the settlement T-Mobile is required to use that money to reinvest it in themselves, to reinvest into the security measures they should have had from the outset. That seems extremely unfair to the victims in this case," Roane told NBC 5.
For those eligible for this settlement, T-Mobile says there is no need to contact the company; it will notify customers. It could be many months before the small checks make their way into the hands of those who were impacted.
