Trump Mobile hacked as 3,615 customer records leak

MW Contributor · 2026-10-08T17:44:28+08:00

Trump Mobile, the wireless service launched by Eric Trump and Donald Trump Jr, has been hacked, with a criminal group publishing the personal records of 3,615 customers on a dark web leak site. The leak is the second data theft claimed against the brand in three weeks and one of several problems to hit the service this year. The group, which calls itself BYOD, said it gained entry by infecting an employee at Liberty Mobile, the Florida-based mobile virtual network operator that runs Trump Mobile's network. BYOD told PCMag it "ratted a Liberty Mobile employee" with a Remote Access Trojan, a type of malware that lets attackers control a device remotely. The stolen access carried "no permissions except to look up prepaid numbers", so the group said it "pivoted to subdomains, which Trump Mobile was exposed, and decided to exfil that". The dumped file contains names, email addresses, phone numbers, home addresses, order histories and plan cancellation records. Reporters at PCMag and Straight Arrow News contacted people listed in the file, and several confirmed the details were accurate. One confirmed the file correctly showed a cancelled "30 Day Unlimited Talk Text Data" plan. Straight Arrow reported that no Trump family member appears in the dataset, though it does include Eric Brunnett, vice president and chief information officer of the Trump Organisation, and a lawyer for the company. The leak also holds details of people who never completed a purchase. One woman told PCMag she never managed to sign up after giving the company her email address and phone number, which would explain her presence in the file. BYOD said the small haul reflects reality: "We only stole 3,615 customers due to the fact that's all they have using their MVNO", meaning people using the carrier rather than buyers of the T1 handset. That figure sits close to earlier reporting. A May flaw on TrumpMobile.com, disclosed by YouTubers Coffeezilla and Cr1TiKaL, suggested the service had about 10,000 unique customers, despite claims that 590,000 people had paid USD 100 deposits for the delayed Trump-branded phone. BYOD is a new ransomware-as-a-service operation, and Trump Mobile is only the third organisation named on its leak site, according to The Register. The group claimed to still have live access to Trump Mobile's backend dashboard and said neither wireless provider used multi-factor authentication. Those claims remain unverified. BYOD alleged that when it warned the company, Trump Mobile replied "We have no team to handle this" and that anyone who hacks them is a terrorist. Neither Trump Mobile nor Liberty Mobile has responded publicly. A second group, EndZone, claimed on 23 September to have stolen data from around 4,000 Trump Mobile users. Security researcher Dominic Alvieri told The Register the dumps "appear to be the same original breach". BYOD denies any affiliation. Researchers at Cybernews reviewed samples and said they looked legitimate and unrelated to earlier breaches. The official wireless agreement states the service is operated by T1 Mobile LLC, trading as Trump SM Mobile, which rents network capacity rather than owning it. That structure means customer data can sit with a third-party operator even though the brand carries the Trump name. Anyone who has shared details with Trump Mobile should watch for phishing emails and calls quoting real order information, use unique passwords, and act quickly if their SIM stops working unexpectedly, a possible sign of a swap attempt.

This topic has 0 replies, 1 voice, and was last updated 1 week, 1 day ago by MW Contributor.

Viewing 1 post (of 1 total)

Posts

October 8, 2026 at 5:44 pm
MW Contributor
Moderator
insert_chart
Trump Mobile, the wireless service launched by Eric Trump and Donald Trump Jr, has been hacked, with a criminal group publishing the personal records of 3,615 customers on a dark web leak site. The leak is the second data theft claimed against the brand in three weeks and one of several problems to hit the service this year.
The group, which calls itself BYOD, said it gained entry by infecting an employee at Liberty Mobile, the Florida-based mobile virtual network operator that runs Trump Mobile’s network. BYOD told PCMag it “ratted a Liberty Mobile employee” with a Remote Access Trojan, a type of malware that lets attackers control a device remotely. The stolen access carried “no permissions except to look up prepaid numbers”, so the group said it “pivoted to subdomains, which Trump Mobile was exposed, and decided to exfil that”.
The dumped file contains names, email addresses, phone numbers, home addresses, order histories and plan cancellation records. Reporters at PCMag and Straight Arrow News contacted people listed in the file, and several confirmed the details were accurate. One confirmed the file correctly showed a cancelled “30 Day Unlimited Talk Text Data” plan. Straight Arrow reported that no Trump family member appears in the dataset, though it does include Eric Brunnett, vice president and chief information officer of the Trump Organisation, and a lawyer for the company.
The leak also holds details of people who never completed a purchase. One woman told PCMag she never managed to sign up after giving the company her email address and phone number, which would explain her presence in the file.
BYOD said the small haul reflects reality: “We only stole 3,615 customers due to the fact that’s all they have using their MVNO”, meaning people using the carrier rather than buyers of the T1 handset. That figure sits close to earlier reporting. A May flaw on TrumpMobile.com, disclosed by YouTubers Coffeezilla and Cr1TiKaL, suggested the service had about 10,000 unique customers, despite claims that 590,000 people had paid USD 100 deposits for the delayed Trump-branded phone.
BYOD is a new ransomware-as-a-service operation, and Trump Mobile is only the third organisation named on its leak site, according to The Register. The group claimed to still have live access to Trump Mobile’s backend dashboard and said neither wireless provider used multi-factor authentication. Those claims remain unverified. BYOD alleged that when it warned the company, Trump Mobile replied “We have no team to handle this” and that anyone who hacks them is a terrorist. Neither Trump Mobile nor Liberty Mobile has responded publicly.
A second group, EndZone, claimed on 23 September to have stolen data from around 4,000 Trump Mobile users. Security researcher Dominic Alvieri told The Register the dumps “appear to be the same original breach”. BYOD denies any affiliation. Researchers at Cybernews reviewed samples and said they looked legitimate and unrelated to earlier breaches.
The official wireless agreement states the service is operated by T1 Mobile LLC, trading as Trump SM Mobile, which rents network capacity rather than owning it. That structure means customer data can sit with a third-party operator even though the brand carries the Trump name.
Anyone who has shared details with Trump Mobile should watch for phishing emails and calls quoting real order information, use unique passwords, and act quickly if their SIM stops working unexpectedly, a possible sign of a swap attempt.
0