Mint Mobile

Summary

Mint Mobile experienced a security incident where an unauthorized party temporarily ported a limited number of subscribers' phone numbers to another carrier and potentially accessed personal information, including names, addresses, emails, passwords, call history, billing details, account numbers, and subscription features. The company reversed the unauthorized porting and restored services, but the breach exposed risks of secondary attacks leveraging the compromised numbers, such as phishing or interception of two-factor authentication codes. Affected users were advised to secure accounts using their phone numbers for verification.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Mint Mobile experienced a security incident between June 8 and June 10, 2021, involving unauthorized access to customer accounts and data. During this period, a threat actor temporarily ported phone numbers belonging to a small number of subscribers to another carrier without authorization. Mint Mobile detected the activity and immediately reversed the porting process to restore affected customers' service. The company determined that the unauthorized individual potentially accessed personal information associated with the compromised accounts, including names, addresses, email addresses, telephone numbers, account passwords, bill amounts, international call detail records, account numbers, and subscription features. While the exact method of access remained undisclosed by Mint Mobile, the nature of the compromised data suggested account takeovers or exploitation of customer management systems.

The breach notification, issued via email to impacted subscribers in July 2021, warned that attackers could leverage the stolen information for secondary attacks. Specific risks included phishing attempts using the accessed personal data and potential compromise of accounts relying on SMS-based two-factor authentication due to the number porting activity. Mint Mobile directed affected customers to change their account passwords and advised vigilance regarding other accounts using their phone numbers for verification. The company did not disclose the total number of impacted subscribers beyond characterizing the scope as "very small." This incident followed a similar pattern to a January 2021 attack against US Cellular, where threat actors socially engineered employees to install remote access tools before manipulating customer relationship management systems to port numbers and extract data.

Sources

Sources available to members: 1 source.