Experian, one of the largest credit agency data brokers in the world, has been hacked. Some 15 million people who used the company’s services, among them customers of cellular company T-Mobile who had applied for Experian credit checks, may have had their private information exposed, the company confirmed on Thursday.

Information from the hack includes names, addresses, and social security, driver’s license and passport numbers. The license and passport numbers were in an encrypted field, but Experian said that encryption may also have been compromised.

Connecticut’s attorney general said he will launch an investigation into the breach.



The company said its consumer credit database was not affected and that “no other clients’ data was accessed”, presumably meaning the damage is limited to T-Mobile.

Experian did not name the perpetrator but in a statement the company said it had contacted law enforcement. The hack specifically affects “those who applied for T-Mobile USA postpaid services or device financing from September 1, 2013 through September 16, 2015”, according to Experian.

“Experian discovered an unauthorized party accessed T-Mobile data housed in an Experian server,” the company said in a questions page addressed to consumers. Experian is offering consumers affected by the breach free credit monitoring services.

T-Mobile said it won’t delete credit check data from the Experian servers because of credit laws that require retention for 25 months.

“Obviously I am incredibly angry about this data breach and we will institute a thorough review of our relationship with Experian, but right now my top concern and first focus is assisting any and all consumers affected,” wrote T-Mobile’s CEO, John Legere. “I take our customer and prospective customer privacy VERY [sic] seriously. This is no small issue for us. I do want to assure our customers that neither T-Mobile’s systems nor network were part of this intrusion and this did not involve any payment card numbers or bank account information.”

Experian’s businesses extend into every area of American life, from customer loyalty cards that track the purchases of everyday necessities to public records including real estate liens and bankruptcy. Its vast database is widely used by automated advertising networks to load ads relevant to a given user, but has many other applications besides.

Jon Mandel, whose data firm PrecisionDemand was sold to AOL for an undisclosed sum last year, now works as a consultant in the industry and said that the breach has wide-ranging consequences across any number of industries. Data brokers, Mandel said, are often trusted by other companies to “anonymize” personally identifying information so as to keep it from accidentally leading to embarrassing mistakes such as the OfficeMax envelope addressed to “Mike Seay – Daughter Killed in Car Crash” (OfficeMax ultimately blamed an unidentified data broker for that incident).

“The irony is that so many companies have used Experian as a ‘clean room’ to put your data together with other companies’ data to keep it from being personally identifiable,” Mandel said. “That very ability can make everything personally identifiable.”



Experian has lobbied in support of the Cybersecurity Information Sharing Act, legislation currently being considered in the Senate that would broaden its immunity were it to share its stores of information with the Department of Homeland Security (which in turn would be compelled to share it with law enforcement and the NSA). “Congress has the responsibility to balance the need for facilitating greater information sharing, and thereby enhancing cybersecurity, with important consumer privacy concerns,” an Experian spokesperson wrote last month. “We encourage and support Congress’s effort in striking this balance.”

The Experian hack is the most recent in a series of data breaches affecting organizations from the US government’s Office of Personnel Management to Target, often to the tune of tens of millions of users. The US government has blamed Chinese hackers for the OPM breach and pulled spies from the country because their cover stories could potentially have been blown by the breach.

Private, identifying information is frequently reappropriated by data thieves, who have used it to wreak havoc among people from employees of multinational tech and entertainment company Sony and users of married hook-up site Ashley Madison, in the latter case leading to widespread blackmail.

With respect to this specific incident, Mandel said: “It’s like anything else in life. All kinds of things sound good but everything’s good in moderation. Sometimes the best medicine turns out to be poisonous.”

The latest incident is the second huge breach linked to Experian. An attack on an Experian subsidiary in 2014 exposed the social security numbers of 200 million Americans and prompted an investigation by at least four states, including Connecticut.



A spokeswoman for Connecticut attorney general George Jepsen said on Thursday that it would investigate the latest attack.



