Trump Mobile has had a rough sixteen months. The “Made in America” phone that was not made in America. The shipping dates that kept sliding. The deposits that, according to the company’s own rewritten terms, were never purchases at all. Now add a data leak to the list, and this time it is not a quiet bug that a YouTuber stumbled across.
A newly formed cybercrime group calling itself BYOD has posted personal records for 3,615 Trump Mobile customers on its dark web leak site. The files include names, email addresses, phone numbers, home addresses and order details. Reporters have called people in the dataset and confirmed their information is accurate. And as of today, nearly two weeks after the data went up, Trump Mobile has not said anything publicly.
Here is what we know, what is still just the attackers’ word, and what you should do if you ever handed this company your details, even if you never finished checking out.
What leaked, and who is in the file
Straight Arrow News broke the story on October 5 after reviewing the dataset and phoning people listed in it. Several confirmed their details were correct. Cybernews looked at samples the next day and said the records appeared genuine and did not match any earlier breach. PCMag reached three more people, one of whom was surprised to see an accurate note that they had canceled a 30 day unlimited plan.
The data appears to cover Trump Mobile’s wireless service more than orders for the gold T1 phone. Entries include plan purchases labeled things like “30 Day Unlimited Talk Text Data,” but also people who paid a $100 phone deposit and never received a device. It also seems to include abandoned sign ups. A few people Straight Arrow contacted confirmed the details were theirs and then denied ever being customers before hanging up, which is what you would expect from someone who typed their address into a checkout form and walked away.
The list is not just ordinary subscribers. According to Cybernews, it includes the Trump Organization’s own chief information officer, the executive responsible for the company’s technology and information security. A lawyer for the Trump Organization also confirmed to Straight Arrow that he had used the service before. Straight Arrow said it found no Trump family members in the file.
How BYOD says it got in
The attackers’ story is consistent in outline, even if the details shift depending on who they were talking to. BYOD told International Cyber Digest it infected an employee of Liberty Mobile, the Florida company that runs the service behind the Trump Mobile brand, with an infostealer. Cybernews and Android Authority describe it as a remote access trojan. The practical difference is small. Either way, malware on one worker’s machine handed over credentials.
From there, BYOD says it moved to exposed Trump Mobile subdomains, pulled the customer data and kept going. The group claims it still has live access to a customer dashboard and sent Straight Arrow a screenshot showing one customer’s details as proof. It also claims neither Trump Mobile nor Liberty Mobile used multi-factor authentication on the accounts involved.
Then there is the line that has been quoted everywhere. In its leak post, BYOD wrote that Trump Mobile was told about the breach and replied that it had “no team to handle this,” adding that anyone who hacks them is a terrorist. That exchange comes only from the attackers, and nobody has confirmed it. It is also the kind of detail a ransomware crew includes on purpose, because embarrassing a victim in public is the whole business model.
For context on how the company is structured: the service is sold by T1 Mobile, a Florida registered company that licenses the Trump name from the Trump Organization. Liberty Mobile operates the wireless side. Its ultimate ownership has not been fully disclosed.
Claims versus confirmed
A lot of the coverage blends what reporters verified with what BYOD said. Separating the two matters, because it changes how worried you should be.
| Claim | Status | Who checked |
|---|---|---|
| Customer records in the dump are real | Confirmed | Straight Arrow, Cybernews, PCMag |
| The data is new, not recycled from older leaks | Confirmed (samples) | Cybernews |
| 3,615 customers affected | Likely | Consistent across reports; Cybernews also says almost 4,000 |
| Entry via malware on a Liberty Mobile employee | Unverified | Attacker statement only |
| No multi-factor authentication in place | Unverified | Attacker statement only |
| Ongoing access to a customer dashboard | Unverified | One screenshot, not independently confirmed |
| “We have no team to handle this” | Unverified | Attacker statement only |
| Systems encrypted or ransom demanded | No evidence | IBTimes UK notes nothing published shows either |
A “ransomware” group that skipped the ransom
The Register describes BYOD as a new ransomware as a service operation, and Trump Mobile is only the third victim named on its site. But nothing published so far shows encrypted systems or a ransom demand. What BYOD has done is the cheaper half of the modern extortion playbook: steal data, then publish it with a mocking note. Its post ended by inviting anyone to “take a gander at it yourself.”
It may not even be first in line. A separate group called EndZone claimed on September 23 that it had data on 4,000 Trump Mobile users. Security researcher Dominic Alvieri told The Register that the EndZone dump “appears to be the same original breach.” BYOD denies any formal link, though a representative told PCMag that one member “just knows a few people behind EndZone.” Two groups claiming roughly the same haul within a week usually means the data has been passed around, and that it will keep circulating.
The second data scare in five months
This is not Trump Mobile’s first leak. In May, YouTubers Voidzilla and penguinz0 were contacted by someone who had found a simple exploit on the Trump Mobile website that exposed customer names, addresses and emails. TechCrunch reported at the time that the company acknowledged customer details had been accessible through a third party platform, while insisting it found no evidence its own network had been breached. It also said it was still deciding whether to notify the people affected.
That May exposure produced one awkward side effect. The data suggested Trump Mobile had only around 30,000 T1 preorders, a long way from the figure of 590,000 deposit holders that had been floating around. Five months later, the company has gone from “still deciding” to silence.
How we got here
When Trump Mobile launched in June 2025, Eric Trump promised it was “going to revolutionize cell phones.” The pitch was a $499 gold T1 phone and a $47.45 a month unlimited plan, sold as an American alternative to the big carriers. What followed was less revolutionary.
The “Made in America” line disappeared from the website within two weeks. Shipping slipped from August 2025 to December, then to March, then to April. In April the company rewrote its preorder terms to state that “a deposit is not a purchase,” which is a remarkable thing to add after taking people’s money. In January, lawmakers had already urged the FTC to look at the brand’s marketing. Phones finally started going out after customers had waited as long as eleven months.
None of that is a security failure on its own. But it paints a picture of a company that was built quickly around a brand rather than around operations, and customer data protection is an operations problem. If BYOD’s claims about missing multi-factor authentication are true, that is the most basic control a company handling thousands of addresses and phone numbers can skip.
What the exposure means for customers
The good news first: no payment card data has been reported in the dump, and there are no Social Security numbers. Nobody is going to drain your account with this file alone.
The bad news is that names, phone numbers, home addresses and order histories are the raw material for convincing scams. A text that says “Trump Mobile: your $100 T1 deposit refund is ready, confirm your details here” will look very believable to someone who actually paid a $100 deposit. So will a call from someone who knows your address and the exact plan you canceled. This is how most mobile account takeovers start, and as we covered earlier this year, device takeovers now outpace classic scams in identity theft reports.
There is also a quieter risk for anyone who is still a subscriber. A phone number plus a home address plus account details is a good starting kit for a SIM swap, where a criminal convinces a carrier to move your number to their SIM and then intercepts your text message login codes.
What to do if you signed up
You do not need to panic, but you should spend ten minutes on this. It applies even if you only started the checkout and never paid.
- Treat every Trump Mobile message as hostile until proven otherwise. Do not tap links in texts or emails about refunds, orders or account problems. If you need to check something, go to the site or app directly.
- Lock down your phone number. If you are still a subscriber, ask for an account PIN and port out protection. If you moved on to another carrier, set the same protections there, since your number is what is in the file.
- Move important logins off SMS codes. Switch your email, bank and social accounts to an authenticator app or, better, passkeys. Our guide on how passkeys work and what happens if you lose your phone covers the setup.
- Watch the mail. Your home address is in the dump. Expect physical mail scams too, such as fake “refund checks” that ask you to call a number.
- Keep an eye on your credit. A credit freeze is not strictly necessary because Social Security numbers were not exposed, but it is free at all three bureaus and costs nothing to leave on.
- Brush up on the usual tells. Our walkthrough on how to spot and avoid online scams is worth sending to any family member who also signed up.
The silence is the story now
Most US states require companies to notify residents when certain personal information is exposed, and many of those rules are triggered by names combined with other identifiers. Whether this specific mix of fields crosses the line in every state is a legal question, but the general expectation is clear: when reporters can confirm that customer records are real, customers deserve to hear about it from the company first.
Trump Mobile has not responded to Straight Arrow. The Trump Organization and Liberty Mobile did not answer The Register. In May, the company at least said it was considering notifications. This time it has said nothing. For a business whose whole proposition was trust in a brand, that may end up costing more than the leak itself.
FAQ
Was my credit card exposed in the Trump Mobile breach?
No payment card data has been reported in the BYOD dump. The exposed fields are names, emails, phone numbers, home addresses and order or plan history.
I only started signing up and never paid. Could I be in the file?
Possibly. Reporters found people in the data who said they were never customers, and the dataset appears to include abandoned sign ups. If you entered your details at checkout, assume they may be exposed.
Is this the same as the May Trump Mobile leak?
No. The May incident involved customer data reachable through a website exploit and a third party platform. Cybernews says samples from the new BYOD dump do not match earlier breaches. A separate group, EndZone, claimed a similar haul on September 23, and one researcher believes that claim stems from the same breach as BYOD’s.
Has Trump Mobile confirmed the breach?
No. As of October 13, 2026, Trump Mobile, the Trump Organization and Liberty Mobile have not publicly responded.
Does the leak include T1 phone orders?
Some entries reference the $100 T1 deposit, but most of the data appears to relate to the wireless service, such as 30 day unlimited plans and cancellations.
About this article: GeekBlog covers U.S. technology news, AI, phones, smartwatches and gaming. Every story is written and checked under our Editorial Policy. Spotted a mistake or have a story tip? Contact our editors.
