INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Trump Mobile customers' data leaked after device shipment issues

| 2026-10-06 17:32 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
On October 6, 2026, the data of approximately 3,615 Trump Mobile customers was leaked online by a ransomware-as-a-service operation called BYOD. The breach is attributed to Straight Arrow News, which first reported it and verified some customer information. The targeted sector is telecommunications, specifically mobile phone services. According to BYOD's claim, they accessed the data after infecting a Liberty Mobile employee with an infostealer and exploiting vulnerabilities in Trump Mobile's systems, where neither provider used multi-factor authentication. The current status of the breach is that the leaked data includes personal information such as names, email addresses, phone numbers, home addresses, and order details, which are now publicly available on the dark web.
Technical Mitigations AI-generated
• Patch the infostealer vulnerability in Liberty Mobile employee's device (infostealer) • Block or hunt for indicator of BYOD ransomware-as-a-service operation • Use multi-factor authentication to secure Trump Mobile systems
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
NORTH_AMERICA NORTH_AMERICA telecommunicationstelecommunications
Incident Timeline
‎2025/10/06
Threat actors dumped data from Trump Mobile customers, including at least one customer who paid a $100 pre-order deposit for the T1 smartphone but never received their gold-colored device.
organisation Straight Arrow
Brunnett’s LinkedIn profile says he oversees “all Information Technology and Information Security for all aspects of the Trump Organization.” Additionally, one customer contacted by Straight Arrow said he paid a $100 pre-order deposit last year for Trump Mobile’s flagship smartphone, the T1, but never received a gold-colored device.
organisation T1
Brunnett’s LinkedIn profile says he oversees “all Information Technology and Information Security for all aspects of the Trump Organization.” Additionally, one customer contacted by Straight Arrow said he paid a $100 pre-order deposit last year for Trump Mobile’s flagship smartphone, the T1, but never received a gold-colored device.
financial $100 $ pre - order deposit
Brunnett’s LinkedIn profile says he oversees “all Information Technology and Information Security for all aspects of the Trump Organization.” Additionally, one customer contacted by Straight Arrow said he paid a $100 pre-order deposit last year for Trump Mobile’s flagship smartphone, the T1, but never received a gold-colored device.
‎2026/10/06
Threat actors used BYOD's ransomware-as-a-service operation to target Trump Mobile, resulting in the data leak of 3,615 customers' personal information.
organisation Trump Mobile
Trump Mobile customers' data dumped - and some never even received their gold device.
organisation BYOD
Criminals called BYOD claim to have broken into the Trump-branded mobile biz and leaked data belonging to 3,615 people, including names, email addresses, phone numbers, home addresses, and order details.
organisation Trump
Criminals called BYOD claim to have broken into the Trump-branded mobile biz and leaked data belonging to 3,615 people, including names, email addresses, phone numbers, home addresses, and order details.
organisation PII
“Well unfortunately for them, all 3615 customers and their PII, alongside telecom details are now up for grabs,” the leak site says.
victims 3615 customers
“Well unfortunately for them, all 3615 customers and their PII, alongside telecom details are now up for grabs,” the leak site says.
organisation International Cyber Digest
The hackers reportedly told International Cyber Digest that they first infected a Liberty Mobile employee with an infostealer, and then accessed Trump Mobile via the MVNO.
organisation Liberty Mobile
The hackers reportedly told International Cyber Digest that they first infected a Liberty Mobile employee with an infostealer, and then accessed Trump Mobile via the MVNO.
organisation Trump Mobile’s
BYOD claims to still have access to Trump Mobile’s systems, and told the publication that neither wireless provider used any form of multi-factor authentication.
organisation the Trump Organization nor Liberty Mobile
Neither the Trump Organization nor Liberty Mobile responded to The Register ’s questions about the breach.
organisation The Register ’s
Neither the Trump Organization nor Liberty Mobile responded to The Register ’s questions about the breach.
organisation the Trump Organization
The leak does, however, include personal information about Eric Brunnett , vice president and chief information officer for the Trump Organization.
organisation EndZone
Another criminal group, EndZone, also claimed to have breached Trump Mobile and leaked a stolen dataset a week before BYOD’s post in what “appears to be the same original breach,” according to security sleuth Dominic Alvieri.
organisation The Register
The individual behind the discovery, who goes by "Louis" and described himself as "just a nerd between jobs with too much time on my hands," previously told The Register that the website’s data could be scooped up with a simple POST request.
organisation POST
The individual behind the discovery, who goes by "Louis" and described himself as "just a nerd between jobs with too much time on my hands," previously told The Register that the website’s data could be scooped up with a simple POST request.
Tactical Metrics
Metrics
financial
100
$ Pre - Order Deposit
Brunnett’s LinkedIn profile says he oversees “all Information Technology and Information Security for all aspects of the Trump Organization.” Additionally, one customer contacted by Straight Arrow said he paid a $100 pre-order deposit last year for Trump Mobile’s flagship smartphone, the T1, but never received a gold-colored device.
Metrics
victims
3,615
Customers
“Well unfortunately for them, all 3615 customers and their PII, alongside telecom details are now up for grabs,” the leak site says.
Intelligence Sources
The Register - CSO 2026-10-06