In 2017, the FCC determined that T-Mobile had violated federal law in a data breach involving customer credit information [1]. There was reportedly no fine because Congress has imposed a strict one-year statute of limitations on FCC enforcement actions.
In 2020, the FCC charged T-Mobile with again violating federal law in failing to protect customer location information [2]. The FCC proposed a $91.6M fine, widely criticized as insufficient at the time [3-4]. I don't believe the FCC has finalized or collected that penalty.
There have been several other incidents, including in 2018 [5], 2019 [6], early 2020 [7], and late 2020 [8].
I hope there has not been a new data breach. But if there has been, this is the latest in a pattern, and the incentives have to change.
[1] https://www.nexttv.com/news/fcc-admonishes-t-mobile-breach-1...
[2] https://www.fcc.gov/document/fcc-proposes-916m-fine-against-...
[3] https://docs.fcc.gov/public/attachments/FCC-20-27A4.pdf
[4] https://docs.fcc.gov/public/attachments/FCC-20-27A5.pdf
[5] https://www.theverge.com/2018/8/24/17776836/tmobile-hack-dat...
[6] https://www.bleepingcomputer.com/news/security/t-mobile-disc...
[7] https://www.bleepingcomputer.com/news/security/t-mobile-data...
[8] https://www.bleepingcomputer.com/news/security/t-mobile-data...