Cyber Group BYOD Leaks Data From 3,615 Trump Mobile Customers
A new ransomware operation claims to have stolen personal records of thousands of prospective users, citing a lack of security response from the Trump Organization.
Key points
- Cybercrime group BYOD published data for 3,615 Trump Mobile accounts, including names, addresses, and phone numbers.
- The group claims entry occurred via malware on a Liberty Mobile employee device, bypassing multi-factor authentication.
- Trump Mobile allegedly told attackers it had no team to handle the incident, according to the cyber group's statements.
Cybercrime group BYOD published personal data belonging to 3,615 Trump Mobile customers in late September 2026, marking a significant breach for the wireless venture. The dataset includes names, email addresses, home addresses, phone numbers, and order details for prospective users of the service.
The leak represents the third organization targeted by BYOD, a newly formed ransomware-as-a-service operation. Although the group typically demands payment, no ransom demand or evidence of encrypted systems has been published for this specific incident, according to IBTimes UK.
View the original post on X
View the original post on X
Breach Mechanics and Response
BYOD claims it gained initial access through malware installed on a Liberty Mobile employee’s device. Reports from International Cyber Digest cite an infostealer, while Cybernews and Android Authority describe the tool as a remote access trojan. From that foothold, the group allegedly pivoted to exposed subdomains belonging to Trump Mobile.
The attackers state they maintain live access to a customer dashboard and claim that neither Trump Mobile nor its operator, Liberty Mobile, utilized multi-factor authentication. BYOD provided a screenshot of a customer dashboard to Straight Arrow News as proof of access, though this access has not been independently confirmed.
Impact and Organizational Stance
The affected data covers the wireless service subscription process rather than orders for the gold-colored T1 smartphone. The dataset includes records for abandoned sign-ups and the contact information for the Trump Organization's Chief Information Officer. Straight Arrow News first reported the leak after reviewing the data and contacting listed individuals.
Trump Mobile has not responded to inquiries from Straight Arrow News. Similarly, neither the Trump Organization nor Liberty Mobile answered questions from The Register. BYOD alleges that Trump Mobile told the group it had "no team" to handle the incident and branded the hackers as terrorists.
What should you do?
Security professionals should monitor for signs of data exposure involving Liberty Mobile or Trump Mobile infrastructure. Organizations with similar wireless service models should audit their subdomain exposure and enforce multi-factor authentication on all administrative dashboards. Users who signed up for the service should expect potential phishing attempts using leaked personal details.
What to do and how to stay safe: Trump Mobile
- Monitor credit reports and bank statements for unauthorized activity if you provided financial details during sign-up.
- Enable multi-factor authentication on any associated accounts, especially those linked to the compromised email addresses.
- Be vigilant for phishing emails or calls claiming to be from Trump Mobile or Liberty Mobile support regarding account issues.
- Consider placing a fraud alert on your credit file to reduce the risk of identity theft using leaked address and phone data.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What specific data was leaked in the Trump Mobile breach?
The leaked dataset includes names, email addresses, home addresses, phone numbers, and order details for 3,615 customers.
Did the hackers demand a ransom for this data?
No ransom demand or evidence of encrypted systems has been published for this incident, according to IBTimes UK.
How did the attackers gain access to the Trump Mobile systems?
BYOD claims it compromised a Liberty Mobile employee's device with malware, then pivoted to exposed Trump Mobile subdomains.
