Cyber Incident Victim: Experian
Date:
Sep 2013
Location:
United States of America
Summary
A cyberattack compromised an Experian server processing credit applications for a telecommunications provider's applicants, exposing sensitive personal data including names, addresses, Social Security numbers, birth dates, and identification documents such as driver's licenses, passports, or military IDs for over 15 million individuals. The unauthorized access targeted records from applicants over a multi-year period, with encrypted elements potentially compromised; the affected entity's own systems were not breached, and financial data remained unaffected. Experian provided two years of credit monitoring to impacted consumers following the intrusion's discovery. This incident marked at least the third major breach disclosed by the credit-reporting agency within a two-year span.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On September 15, 2015, Experian discovered unauthorized access to a server containing highly sensitive personal data for over 15 million U.S. consumers who applied for T-Mobile postpaid services between September 1, 2013, and September 16, 2015. The breach occurred within Experian’s infrastructure while the company processed credit applications on behalf of T-Mobile, though T-Mobile confirmed its own systems and networks were not compromised. Attackers exfiltrated names, addresses, Social Security numbers, birth dates, and identification documents including driver’s licenses, passports, or military IDs. Experian acknowledged that while Social Security numbers and ID numbers were encrypted, investigators determined this encryption might have been compromised during the intrusion. This marked at least the third data breach disclosed by Experian since March 2013. The company initiated an investigation but had not finalized its findings at the time of public disclosure on October 1, 2015.
T-Mobile CEO John Legere publicly condemned the breach, emphasizing his anger and commitment to assisting affected consumers while announcing a comprehensive review of the company’s relationship with Experian. Experian offered two years of free credit monitoring to impacted individuals and published a FAQ detailing steps to place fraud alerts on credit files. Security journalist Brian Krebs criticized the credit monitoring as insufficient, advocating instead for fraud alerts due to their greater effectiveness in preventing identity theft. The breach notification cautioned that initial assessments often underestimate the full scope of such incidents, leaving open the possibility of additional compromised records or services. No evidence suggested theft of payment card numbers or bank account information during the intrusion.