In short
- On October 5, 2026, a new extortion group called BYOD published records of 3,615 Trump Mobile customers on its leak site.
- The records include names, email addresses, phone numbers, home addresses and order details; no passwords or card numbers have been reported.
- BYOD says it got in through malware on the computer of an employee at Liberty Mobile, a partner that provides services to Trump Mobile. That has not been verified.
- Trump Mobile has not publicly confirmed the breach. Reporters confirmed the data with several people listed in it.
On October 5, 2026, an extortion group calling itself BYOD posted records of 3,615 Trump Mobile customers on its leak site. Each record has a name, email address, phone number, home address and order details, such as deposits for the T1 phone and service plans. Straight Arrow News, which first reported the leak, confirmed the details with several people in the data. No passwords or payment card numbers appear in the records described so far. Another group, EndZone, had listed Trump Mobile on September 23, and researchers think the two claims may involve the same data.
BYOD says it first infected the computer of an employee at Liberty Mobile, a company that provides services to Trump Mobile, then used that access to find backend systems and pull the customer list, and that it still had dashboard access on October 5. It also says that when it told Trump Mobile about the breach, the company replied “We have no team to handle this.” Those are the attackers’ claims. Trump Mobile did not respond to requests for comment and has not publicly confirmed the incident.
What the exposed data enables
Names, phone numbers, home addresses and order details are the raw material for convincing scams. A text message about “your Trump Mobile order” or “your T1 deposit” that uses your real name and address is much easier to believe. Expect fake refund offers, delivery notices and account warnings aimed at the people in this list.
Does this touch your business?
Only if someone on your team ordered from Trump Mobile with a work email, a work phone or a company card. If so, tell them to treat any message about that order with suspicion.
The wider lesson is about partners. By the attackers’ account, the break-in did not start at Trump Mobile but on one computer at a service provider with access to its systems. Every contractor and vendor login into your systems is a door you do not fully control.
What to do this week
- Check the addresses that matter. Run work addresses through our free Am I Breached? checker and turn on alerts for the next breach.
- Review vendor and contractor access. List the outside companies with logins to your systems, close what is no longer used, and require multi-factor authentication on the rest.
- Decide who handles a breach report. If someone tells your company it has been breached, that message should reach a named person the same day, not sit in a general inbox.
Frequently asked questions
Has Trump Mobile confirmed the breach?
No. As of October 12, 2026, Trump Mobile had not publicly confirmed it or responded to reporters. Several people in the data confirmed their details were accurate.
Were passwords or payment cards leaked?
None have been reported. The records described include names, email addresses, phone numbers, home addresses and order details.
How did the hackers get in?
BYOD says it infected a computer at Liberty Mobile, a partner of Trump Mobile, with malware and used that access to reach backend systems. This has not been independently verified.
Is this the same as the EndZone claim?
Possibly. EndZone listed Trump Mobile on September 23, and researchers said both claims may involve the same dataset.
Sources: Straight Arrow News | IBTimes UK | Leak-site data from Ransomware.live | Written with AI assistance and checked against these sources on October 12, 2026