AG Harris urges T-Mobile customers to file fraud alert after data breach

California Attorney General Kamala Harris has urged T-Mobile customers to place fraud alerts on their credit records following a massive data breach at a major credit-reporting agency.

The data breach, reported by T-Mobile and credit reporting firm Experian last Thursday, involves the records of around 15 million T-Mobile customers, including those of new customers who applied for credit checks for new service or device financing between Sept. 1, 2013, and this past Sept. 16, according to T-Mobile and Experian officials.

The records included information such as name, address and birth date and encrypted information such as Social Security and ID numbers.

The information could be used for identity theft and especially "new account fraud," meaning new accounts could be opened in the victim's name, Harris said.

T-Mobile customers should request a fraud alert on their account, which notifies merchants and other credit issuers of the potential for fraud and requires them to take extra steps to verify the identity of the applicant, Harris said. The alert lasts 90 days and can be renewed.

Those concerned about identity theft can also request a security freeze, which blocks the opening of new credit accounts unless the customer acts to lift the freeze.

Fraud alerts can be placed with all three major credit bureaus by calling any one of the following numbers: Experian at (800) 397-3742, Equifax at (800) 525-6285 and TransUnion at (800) 680-7289.

Security freezes cost $10 per bureau or $5 for those over 65, but are free to victims of identity theft.

T-Mobile CEO John Legere issued a statement saying that he was "incredibly angry" over the data breach and is reviewing the company's relationship with Experian. The company is offering two years of free credit monitoring to anyone who fears they might have been affected.

Experian CEO Craig Boundy issued a statement apologizing for the breach and describing it as an "isolated incident over a limited period of time" that only affected one server and one client, T-Mobile.