Incident: Experian Data Breach: T-Mobile Customer Information Compromised.

Published Date: 2015-10-01

Postmortem Analysis
Timeline 1. The software failure incident, which was a hack on Experian affecting T-Mobile customers, happened between September 1, 2013, and September 16, 2015, as mentioned in the article [51623]. Therefore, the estimated timeline for the software failure incident would be between September 2013 and September 2015.
System 1. Experian's server housing T-Mobile data [51623]
Responsible Organization 1. The software failure incident, which was a hack on Experian resulting in the exposure of private information of millions of individuals, was caused by an unauthorized party who accessed T-Mobile data housed in an Experian server [51623].
Impacted Organization 1. T-Mobile customers who had applied for Experian credit checks [51623]
Software Causes 1. The software cause of the failure incident was a hack that targeted Experian's server, leading to the exposure of private information of millions of individuals [51623].
Non-software Causes 1. Lack of adequate cybersecurity measures to prevent unauthorized access to sensitive data [51623] 2. Failure to properly encrypt and secure sensitive information such as social security, driver’s license, and passport numbers [51623] 3. Potential oversight in monitoring and securing third-party servers where customer data is stored [51623]
Impacts 1. Private information of 15 million people, including names, addresses, social security numbers, driver’s license numbers, and passport numbers, was exposed due to the hack on Experian [51623]. 2. The breach specifically affected individuals who applied for T-Mobile USA postpaid services or device financing between September 1, 2013, and September 16, 2015 [51623]. 3. Experian offered free credit monitoring services to consumers affected by the breach [51623]. 4. T-Mobile decided not to delete credit check data from Experian servers due to credit laws requiring retention for 25 months [51623]. 5. The breach had wide-ranging consequences across various industries, impacting data brokers' ability to anonymize personally identifying information [51623]. 6. The incident raised concerns about consumer privacy and the balance between cybersecurity and privacy in legislation such as the Cybersecurity Information Sharing Act [51623]. 7. This was the second major breach linked to Experian, with a previous attack in 2014 exposing the social security numbers of 200 million Americans [51623].
Preventions 1. Implementing stronger encryption methods for sensitive data such as social security, driver’s license, and passport numbers could have prevented the incident [51623]. 2. Conducting regular security audits and penetration testing to identify and address vulnerabilities in the system could have helped prevent the hack [51623]. 3. Enhancing employee training on cybersecurity best practices to prevent unauthorized access to sensitive data could have been a preventive measure [51623].
Fixes 1. Enhancing cybersecurity measures within Experian's systems to prevent future hacks and unauthorized access [51623]. 2. Implementing stronger encryption protocols to safeguard sensitive information such as social security, driver’s license, and passport numbers [51623]. 3. Conducting a thorough review of Experian's relationship with T-Mobile to ensure data security and privacy [51623]. 4. Regularly auditing and monitoring data access and usage to detect any suspicious activities promptly [51623]. 5. Collaborating with law enforcement agencies to identify and apprehend the perpetrators responsible for the hack [51623].
References 1. Experian 2. T-Mobile 3. Connecticut’s attorney general 4. T-Mobile’s CEO, John Legere 5. Data firm PrecisionDemand 6. Experian spokesperson 7. Connecticut attorney general George Jepsen

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization (a) The software failure incident has happened again at one_organization: The article mentions that the latest incident involving the hack of Experian is the second huge breach linked to Experian. An attack on an Experian subsidiary in 2014 exposed the social security numbers of 200 million Americans and prompted an investigation by at least four states, including Connecticut [51623]. (b) The software failure incident has happened again at multiple_organization: There is no specific mention in the article about similar incidents happening at other organizations or with their products and services.
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be attributed to the hack on Experian's server, which resulted in the exposure of private information of millions of individuals. The breach occurred due to unauthorized access to T-Mobile data housed in an Experian server, indicating a vulnerability in the design or security measures of the system [51623]. (b) The software failure incident related to the operation phase can be seen in the failure to delete credit check data from Experian servers by T-Mobile. T-Mobile mentioned that they won't delete the data due to credit laws that require retention for a certain period, indicating an operational decision that could potentially contribute to the impact of the breach [51623].
Boundary (Internal/External) within_system (a) within_system: The software failure incident involving Experian being hacked and exposing the private information of millions of individuals was primarily due to contributing factors that originated from within the system. The breach occurred as an unauthorized party accessed T-Mobile data housed in an Experian server, indicating a vulnerability within Experian's own systems [51623]. Additionally, the encryption used to protect certain sensitive information was compromised, suggesting a failure within the encryption mechanisms implemented by Experian [51623].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: - The software failure incident in this case was due to a hack on Experian's server, where an unauthorized party accessed T-Mobile data housed in an Experian server [51623]. - The breach resulted in the exposure of private information of around 15 million people, including names, addresses, social security numbers, driver’s license numbers, and passport numbers [51623]. (b) The software failure incident occurring due to human actions: - Experian confirmed that the hack resulted in the exposure of private information of individuals who had applied for T-Mobile USA postpaid services or device financing between September 1, 2013, and September 16, 2015 [51623]. - T-Mobile's CEO, John Legere, expressed anger over the data breach and mentioned instituting a thorough review of their relationship with Experian [51623].
Dimension (Hardware/Software) software (a) The software failure incident reported in the articles is not directly attributed to hardware issues. The incident primarily involves a hack on Experian's servers, leading to the exposure of sensitive information of millions of individuals [51623]. (b) The software failure incident is attributed to a hack on Experian's servers, indicating a failure in the security measures of the software systems in place. The breach allowed unauthorized access to personal information stored in Experian's servers, highlighting a failure in the software's security protocols [51623].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident in this case is malicious. The incident involved a hack on Experian, a credit agency data broker, where private information of around 15 million people, including customers of T-Mobile, was exposed due to unauthorized access by a third party [51623]. The hack was intentional and aimed at accessing sensitive personal data for potentially harmful purposes.
Intent (Poor/Accidental Decisions) poor_decisions [a] The software failure incident related to the Experian hack can be attributed to poor decisions made by the company. Experian's decision to store sensitive information such as names, addresses, social security numbers, driver's license numbers, and passport numbers in an encrypted field that may have been compromised reflects a poor decision in terms of data security [51623]. Additionally, Experian's involvement in lobbying for the Cybersecurity Information Sharing Act, which could potentially broaden its immunity in sharing information with the Department of Homeland Security, also raises concerns about prioritizing data sharing over consumer privacy [51623].
Capability (Incompetence/Accidental) accidental (a) The software failure incident related to development incompetence is not explicitly mentioned in the provided article. Therefore, it is unknown if the failure was due to contributing factors introduced due to lack of professional competence by humans or the development organization. (b) The software failure incident related to an accidental failure is evident in the article. The incident of Experian being hacked, leading to the exposure of private information of millions of individuals, can be categorized as an accidental failure. The breach was not intentional but occurred due to unauthorized access by a third party, compromising sensitive data such as names, addresses, social security numbers, and more [51623].
Duration permanent The software failure incident reported in the articles is more of a permanent nature. The incident involved a hack on Experian's server, leading to the exposure of private information of around 15 million people, including customers of T-Mobile who had applied for credit checks [51623]. The breach was discovered by Experian, and the company confirmed that unauthorized access had occurred on their server housing T-Mobile data [51623]. Additionally, the breach was not limited to a specific time frame but affected individuals who applied for T-Mobile services over a period from September 1, 2013, through September 16, 2015 [51623]. This indicates a long-standing vulnerability in the system that allowed unauthorized access to sensitive data, making the failure more permanent in nature.
Behaviour crash, other (a) crash: The software failure incident in this case can be categorized as a crash. Experian confirmed that their system was hacked, leading to the exposure of private information of millions of individuals who had used their services, particularly affecting T-Mobile customers who had applied for credit checks [51623]. (b) omission: There is no specific mention of the software failure incident being due to the system omitting to perform its intended functions at an instance(s) in the provided article. (c) timing: The software failure incident is not related to the system performing its intended functions correctly but too late or too early. (d) value: The software failure incident is not related to the system performing its intended functions incorrectly. (e) byzantine: The software failure incident does not involve the system behaving erroneously with inconsistent responses and interactions. (f) other: The behavior of the software failure incident in this case can be categorized as a security breach resulting from a hack that compromised sensitive data stored by Experian, affecting millions of individuals [51623].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, theoretical_consequence (d) property: People's material goods, money, or data was impacted due to the software failure. The software failure incident involving Experian being hacked resulted in the exposure of private information of around 15 million people, including names, addresses, social security numbers, driver’s license numbers, and passport numbers [51623]. This breach of sensitive data could lead to potential financial harm and identity theft for the affected individuals. Additionally, the incident had wide-ranging consequences across various industries due to the compromised data [51623].
Domain finance, government (a) The failed system in this incident was related to the finance industry as Experian, a credit agency data broker, was hacked, leading to the exposure of private information of millions of people who used the company's services, including customers of T-Mobile who had applied for credit checks [51623]. The breach involved sensitive financial data such as social security numbers, driver's license numbers, and passport numbers, highlighting the impact on the finance sector. (h) The incident also has implications for the government sector as Connecticut's attorney general announced an investigation into the breach, indicating the involvement of regulatory bodies in addressing the cybersecurity issues [51623]. (m) Additionally, the breach has broader implications beyond specific industries, affecting various sectors that rely on data brokers like Experian to handle and protect sensitive information. The incident underscores the interconnectedness of industries and the potential risks associated with data breaches in the digital age [51623].

Sources

Back to List