T-Mobile US Inc. has fallen victim to a data breach that exposed the personal details of about 2 million customers.

The company disclosed the incident late Thursday in a note on its website. T-Mobile is warning affected users that the attackers may have accessed their names, email addresses, ZIP codes, phone numbers, email addresses and account numbers as well as information on whether they use prepaid or postpaid services.

Fortunately, the hackers apparently failed to gain access to more sensitive details. T-Mobile specified in the statement that customers’ payment card details, passwords and social security number were not exposed.

A company spokesperson elaborated in a statement to Motherboard that the attack hit an application programming interface that “didn’t contain any financial data or other very sensitive data.” The breach’s limited scope might also be attributable at least partially to what was described as the quick response on the part of T-Mobile’s cybersecurity team. The spokesperson said the incident started early Monday morning and was stopped on the same day.

T-Mobile’s swift reaction may have been why the hackers only managed to steal about 2 million customers’ records. That figure represents just 3 percent of the carrier’s base of 77 million customers. 

The situation could have certainly turned out worse, at least judging by how long it usually takes for companies to deal with breaches. A recent survey of nearly 500 organizations commissioned by IBM Corp. found that the average time to identify a data breach in the enterprise is a staggering 197 days.

The breach at T-Mobile comes a few months after a security researcher discovered a vulnerability in the carrier’s website that enabled anyone with valid phone numbers to retrieve associated customer details. In 2015, the carrier revealed that hackers have stolen data about 15 million customers after breaching credit scoring provider Experian PLC.  

T-Mobile didn’t share any more specifics about the Monday attack except that it’s suspected to have been carried out by hackers belonging to an unnamed “international group.” The incident comes hot on the heels of high-profile data breaches at genealogy company MyHeritage Ltd. and Adidas Ltd AG.

Photo: T-Mobile