T-Mobile fined $60 million for unauthorized data access

A powerful U.S. panel that scrutinizes foreign investments for national security risks has slapped T-Mobile with a record $60 million fine for failing to prevent and report unauthorized access to sensitive data, a senior U.S. government official said on Wednesday.

The fines imposed by the Committee on Foreign Investment in the United States (CFIUS) relate to violations of a mitigation agreement that German-based T-Mobile signed with the committee when it acquired Sprint Inc. for $23 billion in 2020.

In the case of T-Mobile, which is majority owned by Deutsche Telekom, the unauthorized access to sensitive data occurred in 2020 and 2021, U.S. authorities said.

T-Mobile said in a statement that it experienced technical issues during its integration following its merger with Sprint, which affected “information shared from a small number of law enforcement information requests.” The company stressed that no data was leaked by law enforcement, and that the issues were reported in a “timely manner” and “addressed promptly.”

The amount of the penalty, and CFIUS’s unprecedented decision to make it public, signals that the Commission is taking a more forceful approach to enforcement to deter future violations.

“The announcement of the $60 million penalty underscores the Commission’s determination to strengthen CFIUS enforcement by holding companies that fail to comply with their obligations accountable,” one U.S. official said, adding that transparency about enforcement actions will incentivize other companies to comply with their obligations.

Officials told reporters that the commission has issued six fines in the past 18 months, triple the number it had imposed between 1975 and 2022, noting that the fines ranged from $100,000 to $60 million.

T-Mobile’s failure to promptly report the incident delayed CFIUS efforts to investigate and mitigate potential damage to U.S. national security, they added, without providing further details.