Mint Mobile discloses new data breach exposing customer data

Vampires and not Twilight?

I'm pretty sure they're required to disclose that, and since they're already publicly admitting to some breaches, I doubt they'd be trying to hide parts of it while they're already likely being looked into.

It sounds like the data that was gathered is the sort of data that a customer support rep should have access to. They typically can only see pertinent details like what is necessary to verify a customer's identity and their device details, which lines up with what was mentioned in the disclosure. I imagine some CSR probably got their work account phished or something.

Passwords are probably just fine, from the looks of things.

password hashes are getting stored by everyone for future decryption

All that the email I received from them said was that they fixed the problem and there was nothing further I needed to do.

My wife has been with Mint for 5 years now and there have not been any increases to her plan, on the contrary, they increased the data allowance in her tier

Hmm, I think I might be mistaken on that then. I remember them announcing that they were nixing the $15 plan (which a couple of my family members were on), but it's still there. Maybe they reverted it, or it was just Reddit spreading nonsense information. I'll edit my comment.

Eh, I have my folks on t-mo's $15/each for 3.5gb/unl/unl plan. My second line is with tello for $6/mo. $25/mo is cheap compared to my at&t business postpaid plan (phone + laptop + watch for ~$130 out the door), but if I wasn't going for features, I'd be right there with them for the $15 plan. I'd even go both lines from tello, but the difference between tmo qci6 and qci7 is brutal in my area, and often means data becomes completely unusable during the day. Over-subscribed towers. So t-mo MVNOs are a nogo for me, thus $15.

Tello. The service and price have been basically the same as pre-acquisition Mint. They also use T-Mobile's network but are not owned by them (...for now, at least.)

There's chance they did, but I didn't get any kind of announcement email about it. I also used an email alias for my old Mint account, so if I suddenly start getting spam emails to that address, I'll have my answer, lol

While true, I'm not convinced that fully explains it. Having been in IT nearly 2 decades I feel like the second piece is cybersecurity budgets getting slashed. A lot of them have been super-basic shit like someone clicking on a malicious link.

I don't think the problem is "we" securing things (we being cybersecurity professionals). I think the problem is companies seeing that it's cheaper to take the PR hit, pay the ransom, pay for cybersecurity insurance, etc than it is to pay for a properly secured network.

Cybersecurity is hard (citation needed) and costs a lot of money (citation needed). If a company figures it's cheaper to have a breach and deal with the fallout than it is to properly secure shit I can promise you what will happen.

As always, follow the $$$.