Incidents
Ransomware group BYOD leaks 3,615 Trump Mobile customer records after failed talks
By News Desk ·
Key takeaways
- BYOD published 3,615 Trump Mobile customer records including contact information, addresses and order details.
- The group said it reached Trump Mobile through a Liberty Mobile employee infected with credential-stealing malware.
- Trump Mobile operates as an MVNO on T-Mobile's network and does not own wireless towers or network infrastructure.
A ransomware group called BYOD said it leaked 3,615 customer records from Trump Mobile, including contact information, addresses and order details, after the company allegedly declined to pay. EIN Presswire reported the leak, citing The Register. The group said Trump Mobile told it, "We have no team to handle this," and described anyone who hacks the company as "a terrorist."
What BYOD Said About the Trump Mobile Leak
BYOD said it first compromised a Liberty Mobile employee with credential-stealing malware, then used that foothold to reach Trump Mobile through the companies' mobile virtual network operator relationship, according to The Register. The group said it still had access and that neither wireless provider used multi-factor authentication. Trump Mobile is only the third organization the group has named on its leak site.
"Well unfortunately for them, all 3,615 customers and their PII, alongside telecom details are now up for grabs," the group wrote, per The Register. Straight Arrow News, which The Register said first reported the breach, noted the leaked data did not appear to include information related to President Donald Trump or his family. The leak reportedly did include information associated with Eric Brunnett, the Trump Organization's vice president and chief information officer, whose LinkedIn profile says he oversees information technology and information security across the organization.
The Register also reported that another criminal group, EndZone, claimed to have breached Trump Mobile and posted a stolen dataset before the BYOD leak. In May, a security researcher who goes by "Louis" said he found a website flaw, later fixed, that exposed Trump Mobile customer details. Louis told The Register the exposed data could be retrieved with "a simple POST request."
Trump Mobile's Network and Pre-Order Numbers
Trump Mobile operates as an MVNO using T-Mobile's cellular network infrastructure and does not own wireless towers, according to akta.pro company records. The same records list approximately 590,000 to 600,000 pre-orders claimed, with roughly $60 million in deposits collected at $100 each, while breach analysis suggests only approximately 10,000 unique customers and 30,000 total orders. Trump Mobile is a Florida-based MVNO selling a single $47.45/month postpaid plan on T-Mobile's network, bundled with third-party telehealth, roadside and device-protection services, plus the T1 smartphone.
Earlier Trump Mobile Security and Regulatory Events
On October 13, 2026, TechRadar reported that BYOD published personal data for 3,615 Trump Mobile customers, including names, addresses, phone numbers and order details. On October 8, 2026, Seeking Alpha reported that Senator Maggie Hassan alleged Trump Mobile failed to make legally required disclosures about fraud prevention and scammer use, per a Washington Post report. On October 5, 2026, PCMag reported that BYOD claimed to have stolen data from 3,615 Trump Mobile customers by infecting a Liberty Mobile employee with malware, and that one affected customer confirmed her information was in the leaked file.