In late September 2026, a cybercriminal group known as BYOD leaked a trove of personal data belonging to thousands of Trump Mobile customers, exposing names, addresses, phone numbers, and order details. The disclosure highlights ongoing security and operational challenges for the Trump-branded wireless venture.
- BYOD group posted personal data of 3,615 Trump Mobile customers online.
- Access was gained via malware on a Liberty Mobile employee’s device.
- Trump Mobile has yet to publicly address or acknowledge the breach.
What happened
In late September 2026, the cybercrime group BYOD published stolen data from Trump Mobile customers on a dark web leak site. This database contains thousands of records including names, phone numbers, home addresses, email addresses, and details of orders placed with Trump Mobile. The group claims to have infiltrated a Liberty Mobile employee’s device using either an infostealer or a remote access trojan, then further accessed customer systems without multi-factor authentication in place.
This breach follows an earlier claim by another criminal group, EndZone, which asserted they obtained data on roughly 4,000 Trump Mobile users — likely originating from the same initial compromise. The leaked data samples have been verified as genuine by multiple independent sources, confirming the severity and authenticity of the incident.
Why it matters
Trump Mobile launched amid significant hype around its golden smartphone and promises of a revolutionary wireless service made in America. However, repeated delays in shipping, revoked marketing claims, and now multiple security breaches have severely undermined customer trust. The absence of multi-factor authentication and apparent failure to establish an adequate security team further expose operational weaknesses.
For affected consumers, the leak heightens risks of phishing and social engineering attacks, as scammers can exploit exposed personal information to impersonate the carrier or delivery services. While no payment or credit card data has been reported stolen, the presence of order history and contact details provides sufficient material for targeted fraud schemes. Trump Mobile’s lack of communication complicates efforts to protect users.
What to watch next
Industry observers and potential Trump Mobile customers will be monitoring how the company responds to this breach, particularly whether it implements stronger security protocols such as multi-factor authentication and improves customer notification processes. Regulatory scrutiny may increase following past calls for investigation into the brand’s marketing and business practices.
Additionally, it will be important to watch for any further developments on the ransomware or extortion front, as BYOD is connected to a ransomware-as-a-service operation. The unfolding narrative could set precedent for how political or branded tech ventures manage cybersecurity risks in an increasingly hostile environment.