Threat Intelligence · Privacy
Trump Mobile customer data leaked after hackers claim breach
Hackers claim to have accessed personal details of thousands of Trump Mobile customers. The company has not confirmed the breach, but leaked data appears genuine.
Ross GrantUpdated 3 min read
The short version
Hackers say they have leaked the personal details of thousands of Trump Mobile customers. The company has not confirmed the breach, but the leaked data looks real. No payment card information was included, but names, addresses, and phone numbers were exposed. Customers should watch out for phishing scams.
What happened?
Hackers calling themselves BYOD claim to have accessed the personal data of thousands of Trump Mobile customers and posted it online in late September 2026. The company has not confirmed the breach, but journalists and researchers say the leaked data appears genuine. No payment card data was included, but names, addresses and phone numbers were exposed.
What is known so far
Hackers calling themselves BYOD claim to have accessed the personal details of thousands of Trump Mobile customers. They posted a sample of the data to a dark web leak site in late September 2026. According to TechRadar (opens in a new tab), the group did not demand a ransom, but instead published the data directly. Security researchers and journalists who reviewed the leaked information found it appeared genuine, with several people confirming their details were accurate and not part of earlier breaches.
A second group, EndZone, also claimed to have breached Trump Mobile a few days earlier, saying it had data on 4,000 users. Some researchers believe both groups are referring to the same incident, though BYOD denies any formal connection.
How the hackers got in
BYOD told one outlet it compromised a Liberty Mobile employee using an infostealer (a type of malware that steals information), while other reports mention a remote access trojan (malware that lets attackers control a device). After gaining access, BYOD says it moved from the initial device to exposed Trump Mobile subdomains and claims it still has live access to a customer dashboard. The group also alleges that neither Liberty Mobile nor Trump Mobile used multi-factor authentication (MFA), which could have made the attack easier.
What data was exposed
The leaked data includes names, phone numbers, home addresses, and order histories. No payment card details have been reported in the dump, so the main risk to customers is phishing. Scammers could use this information to send convincing fake messages about orders, refunds, or account problems. One person in the data sample confirmed that their record included details of a cancelled mobile plan, suggesting the data is recent and accurate.
Trump Mobile's response
So far, Trump Mobile has not confirmed the breach or notified customers. According to BYOD, the company told them it had no team to handle the incident and called the hackers "terrorists." This claim has not been independently verified. In a previous incident in May, Trump Mobile said it was still deciding whether to notify affected people. This time, it has not commented at all.
Ongoing issues for Trump Mobile
Trump Mobile launched in June 2025 with promises of a "revolutionary" phone, but has faced delays and controversy. Its "Made in America" claim was dropped from the website soon after launch, and shipping dates have repeatedly slipped. In January, lawmakers asked the US Federal Trade Commission to review the company's marketing. The latest breach adds to a series of problems for the brand and its customers.
What customers should do
Anyone who signed up for Trump Mobile, or even started the process, should be cautious about unexpected messages or calls about their account. Do not click on links in suspicious emails or texts, and contact the company directly if you have concerns. Since no payment card data was leaked, the immediate risk is scams rather than direct financial theft, but personal information can still be used for identity fraud or targeted phishing.
What remains unclear
At this stage, only one outlet has reported the breach and the company has not confirmed it. The exact number of affected customers is not certain, and it is not clear whether the attackers still have access to systems. There is also no evidence so far of ransomware or encrypted systems, despite BYOD being described as a ransomware group.
Claimed vs confirmed
- Unconfirmed
Hackers BYOD claim to have breached Trump Mobile and leaked customer data.
Claim made by BYOD and reported by TechRadar, but not confirmed by Trump Mobile.
- Confirmed
Leaked data includes names, addresses, phone numbers, and order histories.
Journalists and researchers contacted people in the data who confirmed its accuracy.
- Confirmed
No payment card data was included in the leak.
Researchers and journalists reviewing the data found no payment card details.
- Unconfirmed
BYOD still has live access to a customer dashboard.
BYOD provided a screenshot as proof, but independent confirmation is lacking.
- Unconfirmed
Trump Mobile told BYOD it had no team to handle the breach and called them terrorists.
This is BYOD's account; Trump Mobile has not commented.
The impact
- Money
- No direct financial loss has been reported, but if confirmed, US law may require Trump Mobile to notify affected customers and could expose the company to regulatory fines.
- Reputation
- The breach, combined with earlier delays and controversies, further damages Trump Mobile's reputation and trust with customers.
- Customers
- Personal details like names, addresses, and phone numbers can be used for phishing and scams. Customers should be cautious with unexpected messages or calls.
Why it matters
If confirmed, this breach puts thousands of people's personal details at risk of scams and identity theft. Even without payment data, exposed names, addresses, and phone numbers can be used by criminals to trick people into revealing more information or money. The company's lack of response leaves customers uncertain about their risk.
How does it work?
Attackers reportedly gained access by compromising a Liberty Mobile employee's device with malware (either an infostealer or a remote access trojan). From there, they accessed exposed Trump Mobile subdomains and a customer dashboard. The absence of multi-factor authentication may have made the attack easier.
Key points
- Hackers claim to have leaked Trump Mobile customer data.
- Leaked details include names, addresses, and phone numbers, but not payment cards.
- The company has not confirmed the breach or notified customers.
- Researchers say the data appears genuine and recent.
- Customers should be alert for phishing scams.
