Loading story…
The ransomware-as-a-service operation BYOD claims to have breached Trump Mobile and published a dataset reportedly containing 3,615 records with names, email addresses, phone numbers, home addresses and order details. Straight Arrow News confirmed some exposed information with affected individuals, although some denied being customers. The dataset reportedly includes Trump Organization vice president and chief information officer Eric Brunnett. Another criminal group, EndZone, published what researcher Dominic Alvieri described as apparently the same dataset a week earlier, leaving its provenance and the full scope of exposure uncertain.
BYOD alleges it infected an employee at Florida-based Liberty Mobile with an infostealer, used that access to reach Trump Mobile’s backend dashboard and retained access to its systems. The infection method, access path and claimed continuing access have not been independently established; the reports also do not establish password or payment-card exposure or ransomware encryption. Trump Mobile previously addressed a website vulnerability that reportedly exposed customer details, but no connection to this leak has been established. The exposed identity and order information could support targeted phishing and payment scams, making verification of third-party access, containment of any compromised sessions and notification of affected individuals key response priorities.
See attribution, scope, and your downstream exposure.
9 events from the most recent confirmed update back to the earliest known activity.
Straight Arrow News reported the incident after reviewing the leaked data and contacting listed individuals, several of whom confirmed their personal details. Some denied being Trump Mobile customers, so the verification did not establish the accuracy of every record.
Sen. Maggie Hassan sent Trump Mobile CEO Patrick O’Brien a letter citing customer-data exposures and questioning the company's authentication practices and robocall-mitigation filings. She also questioned whether Trump Mobile holds the required authorization for its advertised international calling services, raising national-security concerns.
BYOD told PCMag it compromised a Liberty Mobile employee with a remote access trojan, initially obtaining access limited to prepaid-number lookups. The report says BYOD then discovered exposed Trump Mobile subdomains and used them to bypass those restrictions and reach backend databases; this attack sequence has not been independently verified.
BYOD claimed responsibility for breaching Trump Mobile and published records containing names, contact information, home addresses, and order details, including information about Trump Organization CIO Eric Brunnett. The group also claimed continuing backend access and supplied a customer-information screenshot, but ongoing access and ransomware encryption were not confirmed.
The criminal group EndZone claimed to have breached Trump Mobile and published a dataset one week before BYOD's post. Researcher Dominic Alvieri assessed that the two disclosures appeared to involve the same original breach.
BYOD alleged that Trump Mobile responded to its breach warning by saying it had no team to handle the incident. This account of the company's response remains an attacker claim.
BYOD claimed it infected a Liberty Mobile employee with malware, described in The Register's account as an infostealer, and accessed Trump Mobile through the mobile virtual network operator. The infection method and access path have not been independently established.
The Register reported that the website vulnerability identified by Louis had been fixed. No date for the fix was provided.
A researcher using the name Louis said he discovered a Trump Mobile website vulnerability in May that allowed customer details to be retrieved with a simple POST request. The discovery preceded the EndZone and BYOD disclosures; the source does not specify the year.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
6 references tracked. Mallory keeps watching after this page renders.
arstechnica.com
Open sourcescworld.com
Open sourcecyberveille.ch
Open sourcetheregister.com
Open sourcethecybersecguru.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Trump Mobile confirmed that customer personal data was exposed on the public internet after researchers and customers found that preorder and order information could be retrieved through an unprotected API. Reports said the flaw allowed simple HTTP `POST` requests to return records in batches, exposing names, email addresses, mailing addresses, cell phone numbers, order identifiers, and in some cases customer or account numbers and enrollment IDs. Multiple outlets reported that more than 27,000 customers were affected, with leaked order identifiers suggesting roughly 30,000 phone orders tied to the `T1` smartphone launch. The issue was first publicized after YouTubers Coffeezilla and penguinz0 said a researcher alerted them that their own Trump Mobile order details were accessible online, and the researcher reportedly failed to get a response from the company before the exposure became public. Trump Mobile said it found no evidence that payment card data, banking information, Social Security numbers, call records, text messages, or message content were exposed, and attributed the incident to an unnamed third-party platform provider rather than a compromise of its own systems. The company said the flaw has been addressed and an investigation is ongoing, but reports said it was still evaluating whether affected customers would be notified.
Jun 29, 2026
A threat actor has claimed to have breached enterprise intelligence software provider **InfoDesk** and is offering the allegedly stolen data for sale on a dark web forum. Reporting indicates the sample data included five records from each of 18 organizations, along with InfoDesk records, and the actor claimed to hold as many as 1,000 records in total. The exposed information reportedly consists primarily of employee full names and corporate email addresses tied to major organizations, including firms in the pharmaceutical, healthcare, financial, consulting, and nonprofit sectors; Cybernews specifically said the data involved employees at companies such as **Moderna**, **Johnson & Johnson**, and **Bayer**. Researchers said the immediate danger is not large-scale identity theft but highly targeted phishing and social-engineering attacks. Because the records appear linked to a known enterprise vendor, attackers could use the contact details to craft convincing lures for credential theft, malware delivery, or follow-on business email compromise. The alleged incident adds to broader concerns over third-party supplier exposure, where compromises at service providers can create downstream risk for multiple corporate customers at once.
Jun 29, 2026
Cybernews researchers reported multiple **data exposures caused by misconfigured back-end services**, including consumer mobile apps and a large unprotected database. Three widely downloaded Android AI photo identification apps—*Insect Identifier by Photo Cam*, *Dog Breed Identifier Photo Cam*, and *Spider Identifier App by Photo*—reportedly leaked more than **150,000** users’ data via a **Firebase misconfiguration** with inadequate authentication/access controls. Exposed data included email addresses, usernames, profile photos, notification tokens, and **GPS coordinates**; while passwords were not found, researchers noted the location data could enable stalking, doxxing, and targeted scams, and observed indications that automated bots had already discovered the exposed databases prior to the investigation. The apps were attributed to publisher **MobilMinds** (linked to **OZI Technologies**), and the developers reportedly did not respond to requests for comment. Separately, Cybernews identified an **unprotected Elasticsearch cluster** exposing approximately **8.7 billion records** associated with China, including names, birthdates, home addresses, national ID numbers, social media identifiers, usernames, and other account/platform details; the dataset also reportedly contained **plaintext credentials** and corporate/business records, suggesting long-term aggregation. The database’s ownership was not confirmed, but it was subsequently secured; researchers characterized the exposure as a systemic privacy risk potentially affecting hundreds of millions of individuals. Two additional items in the set describe individual bug-hunting writeups (e.g., bypassing mobile controls and abusing password reset/IDOR-style issues) but do not provide verifiable linkage to the specific Firebase/Elasticsearch exposures described above.
Jun 29, 2026