T-Mobile Says Hack Exposed Personal Data of 40 Million People

In response to the breach, the company said it would offer two years of free identity protection services. T-Mobile did not immediately respond to questions about updates to its security systems.

The breach was just one of many cracks in cybersecurity across multiple industries exposed in recent years. Experts repeated concerns on Wednesday that, more and more, companies and institutions do not have the necessary security protocols in place to protect sensitive information.

Recent cyberattacks around the world have taken down operations at gasoline pipelines, hospitals and grocery chains, and have potentially compromised some intelligence agencies. Large financial companies face hundreds of thousands of cyberattacks every day, and sometimes fail to stop them.

“The security programs most companies have are just struggling to keep up,” Daniel Miessler, an information security expert and tech writer in San Francisco, said in an interview. He added that, given the complexity of running a major telecom business and the difficulty in keeping data secure, he was surprised the public did not see more major breaches more often.

Yuan Stevens, a researcher at Ryerson University in Toronto who has studied the 2018 T-Mobile breach, said that the company’s system of handling security complaints put the onus on consumers to keep their information safe.

“I do not think it’s on the individual to protect their data,” Ms. Stevens said. “We should not have to opt out of using services in order to protect ourselves. Instead institutions should be responsible for protecting consumer data.”

Companies that collect information that can be sold on black markets, like consumer data, will always be susceptible to hacks, said Cherise Esparza, a co-founder of Security Gate, a cybersecurity firm. But most companies tend to address blind spots retroactively, or scramble to defend themselves only after a competitor suffers a hack.

“People are starting to see their peers getting hacked, and they don’t want to be in the news,” Ms. Esparza said. But she added that, for many companies, data security drifted as a priority.