- Cybercrime group BYOD published records on 3,615 Trump Mobile customers, including names, home addresses, phone numbers, and order details
- BYOD says it came in via malware on a Liberty Mobile employee’s device, and that Trump Mobile said it had “no team” to respond
- The published data appears to cover wireless service rather than T1 phone orders, and includes abandoned logins and the Trump Organization’s own CIO
A newly formed cybercrime group calling itself BYOD says it stole and published personal data belonging to 3,615 Trump Mobile customers, the latest setback for the Trump-branded wireless venture and its golden T1 smartphone.
Straight Arrow News first reported the leak after reviewing the dataset, which includes names, email addresses, phone numbers, home addresses, and order details, and contact persons listed there.
Trump Mobile did not respond Straight arrowand neither the Trump Organization nor Liberty Mobile, the Florida-based operator behind the service, answered the questions of The register.
Latest Videos FromTechRadar
A ransom note that skips the ransom component
BYOD posted the data to its dark web leak site in late September 2026; a ransomware tracker cited by IBTimes UK dates the entry to September 29. The register describes BYOD as a new ransomware-as-a-service operation, with Trump Mobile as only the third organization named on its site, though IBTimes UK note that nothing published so far shows encrypted systems or a ransom demand.
The group’s account of how it got there is consistent in outline, even if the details differ slightly: BYOD told International Cyber Digest that it compromised a Liberty Mobile employee with an infostealer, while Cybernews and Android Authority describe a remote access Trojan.
Regardless of how they got to the device, BYOD messaging shows that it turned from that foot to exposed Trump Mobile subdomains, still has live access to a customer dashboard, and claims that no company used multi-factor authentication.
As proof, it was sent Straight arrow a dashboard screenshot shows a customer’s personal details, but said access has not yet been independently confirmed. The more damning part of it is that Trump Mobile’s response to this was “We don’t have a team to handle this” and anyone who hacked it as a terrorist, an exchange that claimed BYOD took place.
However, the data held; Straight arrow reached people who confirmed that their details were correct, cybernews said his samples looked genuine and did not match previous violations, and PCMag reached out to three people on file, one of whom was surprised to find an accurate record of canceling a 30-day unlimited plan.
BYOD may not even be the first to pay: a separate group, EndZone, claimed on September 23 to take data on 4,000 Trump Mobile users, IBTimes UK Reports, and security researcher Dominic Alvieri said The register the EndZone dump “appears to be the same original breach.” BYOD denies a formal tie, with a representative saying PCMag that one member “just knows a few people behind EndZone,” according to IBTimes UK.
At launch in June 2025, Eric Trump promised that “Trump Mobile will revolutionize cell phones” — but what followed was less revolutionary.
The “Made in America” promise disappeared from the website within two weeks. Shipments slide from August 2025 to December, then March, then April, and in April the company rewrote its pre-order terms to say that “a deposit is not a purchase.” In January, lawmakers asked the FTC to investigate the brand’s marketing.
For consumers, there is a silver lining: No payment card data was reported in the dump, so the immediate risk is phishing rather than outright fraud. However, this does not completely solve the problem: names, phone numbers, home addresses and order histories are exactly what scammers need to convincingly pose as a carrier or delivery service.
Anyone who signed up, or just started signing up, with Trump Mobile should treat unexpected messages about orders, refunds or account issues with suspicion at a time when Trump Mobile continues to drag its feet on the matter, much like its breach in May, when the company said it was still deciding whether to notify people. This time, however, is a little different: it didn’t say anything at all.
Follow TechRadar on Google News in the add us as a preferred source to get our expert news, reviews and opinion in your feeds.