Dive Brief:

• The Federal Communications Commission reached a settlement with T-Mobile in connection with multiple data breaches between 2021 and 2023 at the mobile carrier and broadband provider, the agency said Monday.  
• In what the FCC describes as a "groundbreaking" settlement, T-Mobile agreed to pay $15.75 million to the U.S. Treasury and make a $15.75 million investment over the next two years to bolster its internal technology. The company agreed to deploy phishing-resistant multifactor authentication across its internal network and adopt a zero trust architecture. 
• T-Mobile also agreed to key governance reforms. Its CISO will make regular reports to the board of directors about the company’s cyber posture and business risks linked to cyber.

Dive Insight:

The settlement raises the bar somewhat on how federal agencies are attempting to regulate how the private sector manages cyber risk. 

The Securities and Exchange Commission has stepped up its enforcement of how publicly traded companies disclose cyber incidents and the Federal Trade Commission has also cracked down on how companies manage consumer data in recent years. 

However, the FCC says this agreement is designed in part to help send a message about how the wireless industry helps manage customer data and is designed to address cyber risk from a national security perspective. 

“With companies like T-Mobile and other telecom service providers operating in a space where national security and consumer protection interests overlap, we are focused on ensuring critical technical changes are made to telecommunications networks to improve our national cybersecurity posture and help prevent future compromises of Americans’ sensitive data,” said Loyaan Egal, chief of the enforcement bureau and chair of the privacy and data protection task force.

T-Mobile in 2022 reached a $500 million class action settlement linked to a 2021 breach involving more than 76 million people. Under that agreement, the company agreed to pay $350 million to the class and make $150 million in data security and cyber investments. 

A 2023 breach exposed the personal data of 37 million T-Mobile customers.

The agreement with T-Mobile arrives just after the FCC reached a $13 million settlement with AT&T in September after a third-party data breach exposed the data of 8.9 million customers. 

Earlier this year, new rules went into effect for when telecom companies have to report data breaches to regulators, law enforcement and customers.