Experian data breach 2015: what happened and what to do

In September 2015, hackers got into an Experian server that held credit-check applications for T-Mobile. Experian is one of the three big US credit bureaus, and T-Mobile used it to check the credit of customers who applied for service or device financing. The breach was at Experian, not on T-Mobile's own systems.

What happened

T-Mobile said the attacker took records of about 15 million people who applied for financing between September 2013 and September 2015. Experian told T-Mobile about the incident on 1 October 2015, and both companies made it public that day. Experian said its consumer credit database was not touched, and that payment card and bank account data weren't involved.

Have I Been Pwned (HIBP) later added a data set that circulated after the breach. It holds about 7.2 million unique email addresses and is flagged as unverified: several HIBP subscribers confirmed parts of it were accurate, but HIBP couldn't establish the original source. Treat it as likely, not proven.

What was exposed

According to HIBP, the data includes names, physical and email addresses, phone numbers, dates of birth and credit status information. It also lists ethnicities, genders, family structure, home ownership, income levels and purchasing habits, which is the kind of profile a data broker keeps.

News reports on the original incident add that Social Security numbers and ID numbers were in the stolen records, stored in encrypted form. T-Mobile said Experian told it the encryption may have been compromised. HIBP's data classes don't list Social Security numbers for its data set, so don't assume yours leaked from this set alone. If you applied for T-Mobile financing in that window, assume it could have.

What it lets criminals do

A name, address, birth date and phone number together are enough to impersonate you on the phone with a bank or carrier, to open accounts in your name, or to write a convincing phishing message. Income and family details make those messages more believable. A Social Security number, if yours was included, raises the stakes: it can be used to open credit or file a fake tax return, sometimes years later.

The company's response

Experian offered affected people two years of credit monitoring and identity resolution services, and told law enforcement. T-Mobile's CEO published a letter to customers explaining the incident.

Who should care

Mostly people who applied to T-Mobile for financing between 2013 and 2015. If that's you and you never froze your credit, this is a good time. A freeze is free, and it blocks most new accounts opened in your name.

Why a credit bureau breach feels different

Most breaches leak an account at one company. This one came from a company whose business is your credit file, and the people affected hadn't chosen to deal with Experian at all. They applied for a phone plan, and the credit check was handed to a third party. That's common in lending: you often have no say in which bureau a retailer or carrier calls.

The practical lesson is that you can't opt out of the data, but you can limit what it unlocks. A credit freeze works whichever bureau holds the report, and it doesn't affect your credit score. Lifting it for a real application takes a few minutes online.