Cybercrime group leaks data of 3,615 Trump Mobile customers in alleged malware attack
A newly formed cybercrime group, BYOD, has claimed responsibility for stealing and publishing the personal data of 3,615 Trump Mobile customers. The breach, allegedly achieved through malware on a Liberty Mobile employee’s device, includes sensitive information such as names, addresses, and order details. Trump Mobile and its affiliates have not responded to requests for comment, raising concerns about their security practices and breach response preparedness.
Editor, Lazyfounder
30 SEC SUMMARY
- A newly formed cybercrime group, BYOD, claims to have stolen and published personal data of 3,615 Trump Mobile customers, including names, addresses, and order details.
- The breach allegedly occurred via malware on a Liberty Mobile employee’s device, with no ransom demand or encrypted systems involved.
- Trump Mobile and Liberty Mobile have not responded to requests for comment, raising concerns about their security practices and breach response protocols.
- Security experts confirmed the authenticity of the leaked data, which includes abandoned sign-ups and even the Trump Organization’s CIO.
- This incident adds to a series of setbacks for Trump Mobile, including delayed shipments and marketing scrutiny.
TABLE OF CONTENTS
KEY HIGHLIGHTS
- BYOD, a cybercrime group, published personal data of 3,615 Trump Mobile customers on its dark web leak site on September 29, 2026.
- The leaked data includes names, home addresses, phone numbers, email addresses, and order details, with security experts confirming its authenticity.
- BYOD claims to have gained access via malware on a Liberty Mobile employee’s device, alleging neither Trump Mobile nor Liberty Mobile used multi-factor authentication.
- No ransom demand or encrypted systems were reported, suggesting a potential shift in tactics away from traditional ransomware.
- Trump Mobile has faced multiple challenges, including delayed T1 smartphone shipments, marketing scrutiny, and poor breach response protocols.
Who is BYOD and what do they claim?
BYOD, a self-described ransomware-as-a-service operation, emerged recently and has claimed responsibility for stealing and publishing the personal data of 3,615 Trump Mobile customers. According to reports by TechRadar, the group posted the stolen data on its dark web leak site on September 29, 2026.
The leaked dataset includes names, home addresses, phone numbers, email addresses, and order details. Security experts and media outlets, including Cybernews and PCMag, have since confirmed the authenticity of the data, with some affected individuals verifying their information.
Unlike traditional ransomware attacks, BYOD has not made any ransom demands or encrypted Trump Mobile’s systems. Instead, the group allegedly gained access via malware on a Liberty Mobile employee’s device, a claim it shared with International Cyber Digest.
How the breach allegedly occurred
BYOD claims to have compromised a Liberty Mobile employee using an "infostealer," a type of malware designed to extract sensitive information from infected devices. The group alleges that neither Trump Mobile nor Liberty Mobile had multi-factor authentication (MFA) enabled, which could have prevented unauthorized access.
According to TechRadar, BYOD stated that it targeted Liberty Mobile as a pathway to Trump Mobile’s customer data. The group’s representative told PCMag that while they are not formally tied to another cybercrime group, EndZone, some members have connections to it.
The breach reportedly includes abandoned sign-ups and even the personal data of the Trump Organization’s Chief Information Officer (CIO), suggesting a broad and unsecured dataset.
Trump Mobile’s response—or lack thereof
Trump Mobile and Liberty Mobile have not responded to requests for comment from multiple media outlets, including TechRadar and The Register. According to BYOD, Trump Mobile told the group there was "no team" available to address the breach when contacted.
This incident is not the first time Trump Mobile has faced security concerns. In May 2026, the company reportedly took weeks to decide whether to notify customers about a separate breach. Earlier, lawmakers urged the Federal Trade Commission (FTC) to investigate Trump Mobile’s marketing practices, citing potential misleading claims.
The company has also faced operational setbacks, including repeated delays in shipping its T1 smartphone. The "Made in America" promise, initially featured prominently on its website, was removed within two weeks of its launch.
Broader implications for the smartphone industry
The Trump Mobile breach is the latest in a series of cybersecurity incidents targeting wireless service providers and smartphone manufacturers. Earlier in September 2026, a separate group, EndZone, claimed to have stolen data on 4,000 Trump Mobile users. Security researcher Dominic Alvieri told The Register that the EndZone dump "appears to be the same original breach" as BYOD’s.
The incident highlights the growing risks of supply chain attacks, where cybercriminals target third-party vendors to gain access to larger datasets. For startups and established companies alike, this underscores the need for robust security measures, including MFA, employee training, and regular audits of third-party partnerships.
What this means
Lazyfounder analysis — our interpretation, not reported fact.
This breach is a stark reminder that cybersecurity is not just an IT issue but a core business risk. For founders and operators, the lack of response from Trump Mobile is a cautionary tale—ignoring or delaying action on security incidents can amplify reputational damage and regulatory scrutiny. The alleged absence of multi-factor authentication and reliance on third-party vendors without proper safeguards are common pitfalls, especially for startups scaling quickly.
The shift away from traditional ransomware to data leaks without demands also signals an evolving threat landscape. Cybercriminals are increasingly focused on maximising disruption and exposure rather than financial gain, which can be even more damaging for brands. Startups in the tech and telecommunications sectors must prioritise proactive security measures, transparent communication, and incident response plans to mitigate these risks.
Key takeaways
- For startup founders, this breach highlights the critical importance of robust security protocols, including multi-factor authentication and employee training to prevent malware infections.
- Operators must prioritize breach response plans to avoid reputational damage and regulatory scrutiny, especially in industries handling sensitive customer data.
- The incident underscores the growing trend of cybercriminals targeting supply chains and third-party vendors to gain access to valuable data.
- Transparency and timely communication with affected customers are essential to maintaining trust and compliance with data protection regulations.
FAQ
What data was leaked in the Trump Mobile breach?
The leaked data includes names, home addresses, phone numbers, email addresses, and order details of 3,615 Trump Mobile customers.
How did BYOD allegedly gain access to Trump Mobile’s data?
BYOD claims to have compromised a Liberty Mobile employee’s device using malware, allegedly due to the lack of multi-factor authentication on Trump Mobile’s systems.
Has Trump Mobile responded to the breach?
As of now, Trump Mobile and Liberty Mobile have not responded to requests for comment from media outlets or the cybercrime group.
Is this the first breach involving Trump Mobile?
No, a separate group, EndZone, claimed to have stolen data on 4,000 Trump Mobile users earlier in September 2026.
What can startups learn from this incident?
Startups should prioritize robust security protocols, including multi-factor authentication, employee training, and third-party vendor audits, to prevent similar breaches. Additionally, having a breach response plan in place is critical to maintaining customer trust and regulatory compliance.
Related on Lazyfounder
Sources
- TechRadar · 2026-10-13
Hackers claim to have hit thousands of Trump Phone customers as the bad news for golden smartphone fans continues
This story is an original summary drafted with AI by Lazyfounder from the reporting listed above and checked by automated validation. Facts are attributed to their original publishers; sections marked as analysis are Lazyfounder's. Where a source is in another language, facts were machine-translated and quotations are reported, not reproduced. Read the original coverage via the links, and see our AI policy and corrections policy.
About the author
Editor, Lazyfounder
Tarun Mottlia edits LazyFounders, covering Indian startups, funding rounds, AI and product launches. Every story on the site is AI-assisted and checked against its cited sources before publication.
More stories by Tarun MottliaGet the LazyFounder Brief
Startup, funding and AI news in a five-minute read. Join the early-access list.
