Hackers Claim They Breached T-Mobile More Than 100 Times in 2022

Re:Hackers Claim They Breached T-Mobile More Than 100 Times ... by px43 on Tuesday February 28, 2023 @06:45PM (#34976594)

Read up on credential stuffing, this is increasingly common. With all the recent breaches, there are groups that use old passwords to quickly identify MFA locked accounts behind re-used passwords. These lists are then sold to people who will, one at a time, pay about 10k for a SIM swap on individually targeted users.

There are lists floating around with 10s of thousands, or hundreds of thousands of users with known passwords in Google, Amazon, Paypal, Coinbase, etc.

Episode 112 of Darknet Diaries (March last year) has a really good breakdown of these markets: https://darknetdiaries.com/episode/112/

[ Parent | on HN ]

Re:Hackers Claim They Breached T-Mobile More Than 100 Times ... by ghostpepper on Tuesday February 28, 2023 @09:42PM (#34978112)

The parent comment has a point though - after SIM swap attack, all SMS messages would stop arriving at the victim device - unless the attackers swap it back again after every 2FA code. If they had access to a dashboard at t-mobile this might be possible but it sounds like a lot of effort to steal a few thousand dollars.

[ Parent | on HN ]

Re:Hackers Claim They Breached T-Mobile More Than 100 Times ... by mrb on Wednesday March 01, 2023 @01:44AM (#34979465)

The victim (ctvo) claims in another comment down the thread that he had a unique Gmail password not re-used on any other service. So I wrote my comment assuming this is true. But, indeed, if his Gmail password was weak and guessable, then the T-Mobile hack would have allowed the hackers to validate MFA and log in.

[ Parent | on HN ]