07.02.2025
1 min
944
The Trump Mobile data breach exposed the personal information of nearly 4,000 people, including an executive responsible for cybersecurity across Donald Trump’s business operations.
Last week, a new cybercriminal group calling itself BYOD published information about 3,615 Trump Mobile users on its dark web leak site. According to available data, the exposed information included names, email addresses, phone numbers, home addresses, and order details. Analysis of the published samples suggests that the data is likely authentic and does not appear to be connected to any previous breaches.
Among those affected was Eric Brunnett, vice president and chief information officer of the Trump Organization, which oversees the Trump family’s business operations. His LinkedIn profile states that he is responsible for “all information technology and information security across all aspects” of the organization.
Last year, in an interview with Hospitality Upgrade, where Brunnett was described as a “technology rock star,” he said that an “unimaginable number of bad actors try to get into our network every day.”
“We have to maintain a level of security that allows for zero breaches,” he added.
Although Brunnett’s personal information appears among the data linked to Trump Mobile users, no members of the Trump family were found among the customers whose information was exposed.
In its initial breach post, BYOD said it had notified Trump Mobile about the compromise but allegedly received a response stating that the mobile operator “does not have a team to deal with this issue” and that “anyone who hacks their devices is a terrorist.”
“Unfortunately for them, all 3,615 customers and their personal data, as well as telecommunications information, can now be used for personal purposes,” BYOD said.
According to reports, the attackers gained initial access after infecting a Liberty Mobile employee’s device with a remote access trojan. Liberty Mobile is a Florida-based mobile virtual network operator that provides the infrastructure used by Trump Mobile.
The hackers claim they then moved to unsecured Trump Mobile subdomains and stole customer data. BYOD also says it still retains “operational access” to the Trump Mobile management panel.
Straight Arrow contacted several people whose information appeared in the dataset and confirmed the accuracy of some of the leaked data.
One affected customer said he paid a $100 deposit for a Trump Mobile T1 smartphone but never received the device. Another woman told PCMag that she was never able to successfully register for Trump Mobile or place a preorder for the T1.
During the registration attempt, she provided the company with her email address and phone number, which later also appeared among the stolen data.
The latest incident is not the first time Trump Mobile has faced controversy over the exposure of customer information. Previously, a vulnerability in the T1 preorder system resulted in the exposure of names, addresses, and order information belonging to roughly 30,000 people.
Trump Mobile launched in June last year with a gold-colored smartphone priced at $499. The company primarily targeted conservative consumers and positioned its service as an alternative to major telecommunications carriers.
Trump Mobile operates through T1 Mobile, a company registered in Florida. The full ownership structure of the business has still not been completely disclosed. The Verge previously reported on the company’s ownership structure.
