T-Mobile Didn't Tell SIM Card Breach Victim About Prior Data Breaches, Says Suit

T-Mobile’s correspondence to a SIM card breach victim was “so nonchalant” it didn’t offer him theft protection services, plaintiff Vahid Chitsazzadeh said in a privacy complaint (docket 23st-cv-11402) Sunday in Superior Court for California in Los Angeles.

In late May 2020, T-Mobile notified Chitsazzadeh, a California resident, that an “unknown number” had used his SIM card. The carrier didn’t notify him then of a data breach, nor did it explicitly say his personal data had been compromised by the data hack, said the plaintiff. He learned “months later” T-Mobile had suffered multiple data breaches before the notice of the SIM incident and that his personal data had been compromised, said the complaint. That information wasn't included in the May 2020 correspondence to Chitsazzadeh, “despite their obligation to do so.”

Chitsazzadeh would have undertaken stronger identity theft protection measures if T-Mobile had been “up front” about the data breach in May 2020, said the complaint. He suffered actual damages and continues to suffer damages on the information and belief that his personal data has been “accessed by hackers and is available on the dark web.”

T-Mobile profits from the sale of its wireless phone service, said the complaint. Without its representations about the safety and security of consumers’ personal data, many of its customers wouldn't have purchased its products and services, it said.

T-Mobile used false advertising, marketing and misrepresentations to “induce” Chitsazzadeh to use its services, an “unlawful” business practice under California’s Business and Professions Code, which also prohibits fraud and unfair business acts, the complaint said. The plaintiff also alleges violation of California’s Unfair Business Practices Act, Consumer Privacy Act and Customer Records Act.

Chitsazzadeh seeks an injunction requiring T-Mobile to stop advertising its services as safe and secure, to implement protocols to prevent further data breaches and to be sure consumers “are adequately notified in the event of a breach of their personal data." He seeks an award of damages he has suffered, plus costs and reasonable attorneys’ fees. T-Mobile didn’t comment.