Trump Mobile Customer Data Leaked in Alleged Supply-Chain Breach
A cybercrime group known as BYOD has reportedly leaked personal data belonging to 3,615 Trump Mobile customers, including names, home addresses, phone numbers, email addresses, and order details. The breach was confirmed after Straight Arrow News reviewed the exposed records and contacted affected individuals, who verified the accuracy of their information.
Trump Mobile, a branded wireless service operated under Liberty Mobile a Florida-based mobile virtual network operator (MVNO) resells access to another carrier’s network. While the MVNO model is legitimate, the breach highlights vulnerabilities in third-party supply chains.
How the Attack Allegedly Unfolded
BYOD claims it gained initial access by infecting a Liberty Mobile employee’s device with a remote-access trojan (RAT), allowing attackers to monitor and control the machine. From there, the group says it exploited exposed Trump Mobile subdomains to extract customer records. While these claims remain unverified, the leaked data appears authentic based on independent reviews.
The attackers also assert they still have access to a Trump Mobile backend dashboard, providing a screenshot as purported evidence. If true, this breach underscores how device-level compromises can escalate into larger infrastructure breaches.
Notable Details and Accountability Gaps
Among the leaked records was the information of Eric Brunnett, the Trump Organization’s VP and CIO, responsible for IT and cybersecurity oversight. His inclusion in the dataset raises concerns about the scope of the breach and the adequacy of the response.
According to BYOD, when notified of the breach, Trump Mobile allegedly responded: "We have no team to handle this." As of available reports, Trump Mobile has not publicly confirmed the breach, nor is there evidence that affected customers were formally notified, credentials were revoked, or regulators were engaged.
Industry-Wide Implications
The incident exposes a critical flaw in the MVNO model: while brands outsource network operations, they retain responsibility for customer data. When breaches occur, accountability often falls through gaps in vendor contracts, leaving customers without clear recourse. The case highlights the need for mandatory breach-response obligations across all layers of the supply chain, not just at the carrier level.
Source: https://www.yahoo.com/news/us/articles/trump-mobile-data-breach-exposed-172157664.html
Liberty Mobile TPRM report: https://www.rankiteo.com/company/liberty-mobile
"id": "lib1791311370",
"linkid": "liberty-mobile",
"type": "Cyber Attack",
"date": "10/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '3,615',
'industry': 'Telecommunications',
'location': 'Florida, USA',
'name': 'Trump Mobile',
'type': 'Mobile Virtual Network Operator (MVNO)'},
{'industry': 'Telecommunications',
'location': 'Florida, USA',
'name': 'Liberty Mobile',
'type': 'Mobile Virtual Network Operator (MVNO)'}],
'attack_vector': 'Remote-Access Trojan (RAT), Exploited Subdomains',
'customer_advisories': 'No formal notifications sent to affected customers',
'data_breach': {'data_exfiltration': 'Yes',
'number_of_records_exposed': '3,615',
'personally_identifiable_information': 'Names, home '
'addresses, phone '
'numbers, email '
'addresses',
'sensitivity_of_data': 'High (names, addresses, phone '
'numbers, emails)',
'type_of_data_compromised': 'Personally Identifiable '
'Information (PII), Order '
'details'},
'description': 'A cybercrime group known as BYOD has reportedly leaked '
'personal data belonging to 3,615 Trump Mobile customers, '
'including names, home addresses, phone numbers, email '
'addresses, and order details. The breach was confirmed after '
'Straight Arrow News reviewed the exposed records and '
'contacted affected individuals, who verified the accuracy of '
'their information. The attackers claim to have gained access '
"via a Liberty Mobile employee's device infected with a "
'remote-access trojan (RAT) and exploited exposed Trump Mobile '
'subdomains.',
'impact': {'brand_reputation_impact': 'Potential reputational damage due to '
'lack of public response',
'data_compromised': 'Names, home addresses, phone numbers, email '
'addresses, order details',
'identity_theft_risk': 'High (PII exposed)',
'systems_affected': 'Trump Mobile backend dashboard, Liberty '
'Mobile employee device'},
'initial_access_broker': {'backdoors_established': 'Alleged access to Trump '
'Mobile backend dashboard',
'entry_point': 'Liberty Mobile employee device (RAT '
'infection)'},
'investigation_status': 'Unverified claims by threat actor; no official '
'confirmation from Trump Mobile',
'lessons_learned': 'The incident highlights vulnerabilities in third-party '
'supply chains, particularly in the MVNO model, where '
'accountability for data breaches may fall through gaps in '
'vendor contracts. It underscores the need for mandatory '
'breach-response obligations across all layers of the '
'supply chain.',
'post_incident_analysis': {'root_causes': 'Device-level compromise (RAT), '
'exposed subdomains, lack of '
'incident response team'},
'recommendations': 'Implement mandatory breach-response obligations for MVNOs '
'and their partners, enhance employee device security, '
'conduct regular vulnerability assessments of subdomains, '
'and establish clear incident response protocols.',
'references': [{'source': 'Straight Arrow News'}],
'regulatory_compliance': {'regulatory_notifications': 'No evidence of '
'regulatory engagement'},
'response': {'communication_strategy': 'No public confirmation or customer '
'notifications',
'incident_response_plan_activated': "No (alleged response: 'We "
'have no team to handle '
"this')"},
'threat_actor': 'BYOD',
'title': 'Trump Mobile Customer Data Leaked in Alleged Supply-Chain Breach',
'type': 'Data Breach',
'vulnerability_exploited': 'Exposed Trump Mobile subdomains, Device-level '
'compromise'}