GoogleFi Hacked on the heels of T-Mobile’s 37 Million Customer Data Breach

The data breach comes after T-Mobile, one of Google Fi’s parent tower companies for service, suffered a massive data breach affecting 37 million customers.  

T-Mobile revealed at the end of January that an API flaw was exploited, which resulted in hackers gaining access to customer’s account data, including name, billing address, email, phone number, date of birth, T-Mobile account number, and information about the number of lines on the account and plan features. 

However, not all Google Fi customers received the same information.  

“Additionally, on January 1, 2023 for about 1 hour 48 minutes, your mobile phone service was transferred from your SIM card to another SIM card. During the time of this temporary transfer, the unauthorized access could have involved the use of your phone number to send and receive phone calls and text messages. Despite the SIM transfer, your voicemail could not have been accessed. We have restored Google Fi service to your SIM card.” Came the notice from Google Fi to the customer.  

The customer reported on Reddit that they received multiple unauthorized access and password reset notifications. These notifications came from their email addresses, outlook accounts, crypto wallet accounts, and even Authy – a token authentication app. The alleged access to Authy was allowed to an internal setting of Authy which allowed multiple devices to access the app, a setting that needs manually turned off by customers.  

The customer recounted watching “in real time” their accounts being hacked and stolen, including banking accounts. Worse, the customer only knew this was happening because of email alerts as the SMS authentication alerts were not being sent to their phone. This was because the hacker had stolen access to their SIM and phone number. Within minutes, the hackers had access to their two-factor authentication codes, Authy token authentication app, and more.  

“The hacker used this to take over three of my online accounts — my primary email, a financial account, and the Authy authenticator app, all because they were able to receive my SMSes and therefore defeat SMS-based 2-fac,” 

SIM Swapping is a form of social engineering in which a cyber criminal impersonates you to your mobile carrier and convinces them to transfer your phone number to a mobile SIM card that they control. Once the number is ported, the attacker has access to your text messages, including MFA codes, and can then use that information to breach your online accounts or take over services secured by your phone number. 

Once the number is ported, the threat actors would have access to the victim’s text messages, including multi-factor authentication codes, which could be used to breach online accounts or take over services secured by the person’s phone number.  

Currently, cyberanalysts are researching this breach and believe that Google Fi’s access could be related to the T-Mobile breach due to T-Mobile being one of the parent tower service companies for Google Fi’s service.