LAPSUS$ access to T-Mobile internal tools with stolen credentials
In March 2022 LAPSUS$ members used stolen credentials to access T-Mobile internal systems that house operational tools, and leaked chats show they stole source code. T-Mobile told KrebsOnSecurity on April 22, 2022 that the systems contained no customer or government information and that the accounts were isolated and revoked.
- Victim
- T-Mobile US
- Industry
- Telecom
- Country
- United States
- Intrusion began
- Mar 2022
- First disclosed
- Apr 22, 2022
- Actor
- LAPSUS$ (Extortion group)
- Initial access
- Stolen credentials
- Identity control that failed
- Authentication
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
Credentials bought or phished from employees and contractors stay useful until sessions are bound to managed devices and logins require phishing-resistant MFA.
Sources
- Leaked Chats Show LAPSUS$ Stole T-Mobile Source Code, KrebsOnSecurity, Apr 22, 2022
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- AT&T call and text records stolen from its Snowflake workspace 2024 · Stolen credentials
- PowerSchool SIS data theft through a compromised support-portal credential 2025 · Stolen credentials
- TeamViewer corporate IT intrusion via a compromised employee account 2024 · Stolen credentials
- Neiman Marcus customer data stolen from its Snowflake account 2024 · Stolen credentials
Cite this record
SWI Community Team. (2026). LAPSUS$ access to T-Mobile internal tools with stolen credentials. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2022-t-mobile-lapsus-stolen-credentials/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.