Hassan seeks answers on Trump Mobile data and FCC filings

• On 8 October, Senator Maggie Hassan asked Trump Mobile chief executive Patrick O’Brien to explain the company’s data safeguards, its relationship with Liberty Mobile and its federal filings. She set a 29 October deadline for a response.¹
• Trump Mobile acknowledged that customer information was exposed in May through a third-party platform. Two ransomware groups later claimed to have stolen user data, but it is unclear whether their claims concern the same dataset.¹²
• Hassan says her searches found no robocall-database records under Trump Mobile or its operating company, T1 Mobile. She says Liberty Mobile’s filing appeared to lack required customer-verification information.¹
• Liberty Mobile was not among the 14 companies the Federal Communications Commission removed from that database on 2 September. A third-party index lists a February recertification, but does not verify the current filing or its contents.³⁴

The question at the centre of Hassan’s letter is who is responsible when customer information passes through a network of companies. Trump Mobile resells wireless service rather than running its own mobile network. Its terms have described Liberty Mobile Wireless as powering the service; Hassan says Trump Mobile executives later called Liberty its “backbone”. Her letter asks which carriers and intermediaries handle the service, and what each company does to protect subscribers.¹

The data concerns are not all the same incident. In May, Trump Mobile confirmed that a third-party platform had exposed customers’ names, email and postal addresses, mobile numbers and order identifiers. The company said it had found no evidence that financial information or content was exposed, and said its own network, systems and infrastructure had not been breached.²

In September and October, ransomware groups separately claimed to have stolen personal and telecommunications information linked to Trump Mobile users. The Washington Post reported that hackers had posted personal information belonging to more than 3,000 customers; Ars Technica reported the attackers’ claim of 3,615 records. Those are reported claims, not a company- or regulator-confirmed count. Hassan’s letter says later reporting suggests the groups may have relied on the same underlying dataset, so the claims cannot be treated as proof of two separate breaches or added to the May exposure.¹⁵⁶

The filings raise a separate issue. The FCC’s February advisory says mobile virtual network operators that resell voice service must file a certification and robocall-mitigation plan in its Robocall Mitigation Database, and respond to traceback requests. Hassan says searches found no records for Trump Mobile or T1 Mobile, and that Liberty Mobile’s plan appeared to lack a description of its “know your customer” procedures. The Washington Post reported that its own searches did not find such a plan for either company.¹⁷⁵

But Liberty’s status should not be conflated with the FCC’s September removal order. That order names 14 companies whose certifications were removed; Liberty Mobile Wireless is not among them. A third-party index lists Liberty’s filing as recertified on 27 February, with a later data refresh in September. That index is not the live FCC filing, however, and does not settle whether the filing was complete or current on 9 October.³⁴

Hassan also questions whether the companies have the authorisations needed for the international calling Trump Mobile advertises. Her letter says searches of FCC records did not surface the relevant authorisation and asks whether an underlying provider supplies the service under its own authority. That search result leaves a key part of the arrangement unresolved: which company actually provides the international calls, and on what basis.¹⁵⁶

The Washington Post and Ars Technica reported no immediate response from the companies to their requests for comment. Hassan’s letter asks Trump Mobile to explain the companies’ respective roles, provide relevant filings and describe how they verify subscribers and handle the reported data incidents. The response deadline is 29 October.¹⁵⁶

Footnotes

1. Senator Maggie Hassan’s 8 October letter and Joint Economic Committee release ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸

2. TechCrunch report on Trump Mobile’s May data exposure ↩ ↩²

3. FCC Enforcement Bureau, Order DA 26-872 ↩ ↩²

4. FCC.report index for Liberty Mobile Wireless ↩ ↩²

5. The Washington Post’s 8 October report ↩ ↩² ↩³ ↩⁴

6. Ars Technica’s 8 October report ↩ ↩² ↩³

7. FCC Enforcement Bureau, Advisory DA 26-174 ↩