- Cybercrime group BYOD has published records on 3,615 Trump Mobile customers, including names, home addresses, phone numbers, and order details
- BYOD says it got in via malware on a Liberty Mobile employee’s device, and that Trump Mobile told it there was “no team” to respond
- The published data appears to cover the wireless service rather than T1 phone orders, and includes abandoned sign-ups and the Trump Organization’s own CIO
A newly formed cybercrime group calling itself BYOD says it has stolen and published personal data belonging to 3,615 Trump Mobile customers, the latest setback for the Trump-branded wireless venture and its gold-colored T1 smartphone.
Straight Arrow News first reported the leak after <a href="https://myappsplus.com/iphone-18-pro-and-18-pro-max-review-apples-best-camera-isnt-for-everyone/” title=”iPhone 18 Pro and 18 Pro Max Review: Apple’s Best Camera Isn’t for Everyone”>reviewing the dataset, which contains names, email addresses, phone numbers, home addresses, and order details, and contacting people listed in it.
Trump Mobile has not responded to Straight Arrow, and neither the Trump Organization nor Liberty Mobile, the Florida-based operator behind the service, answered questions from The Register.
A ransom note that skipped the ransom component
BYOD posted the data to its dark web leak site in late September 2026; a ransomware tracker cited by IBTimes UK dates the entry to September 29. The Register describes BYOD as a new ransomware-as-a-service operation, with Trump Mobile as only the third organization named on its site, though IBTimes UK notes that nothing published so far shows encrypted systems or a ransom demand.
The group’s account of how it got in is consistent in outline, even if the details differ slightly: BYOD told International Cyber Digest it compromised a Liberty Mobile employee with an infostealer, while Cybernews and <a href="https://www.androidauthority.com/trump-mobile-subscriber-data-leak-3719958/” rel=”nofollow noopener” target=”_blank”>Android Authority describe a remote access trojan.
Regardless of how they got onto the device, BYOD’s messaging indicates it pivoted from that foothold to exposed Trump Mobile subdomains, still has live access to a customer dashboard, and claims neither company used multi-factor authentication.
As proof, it sent Straight Arrow a dashboard screenshot showing one customer’s personal details, but said access has not been independently confirmed yet. The more damning part of this is that Trump Mobile’s answer to this has been “We have no team to handle this” and branding anyone who hacked it a terrorist, an exchange that BYOD alleges took place.
The data, however, has held up; Straight Arrow reached people who confirmed their details were accurate, Cybernews said its samples looked genuine and did not match earlier breaches, and PCMag reached three people in the file, one of whom was surprised to find an accurate record of canceling a 30-day unlimited plan.
BYOD may not even be the first to cash in: a separate group, EndZone, claimed on September 23 to have taken data on 4,000 Trump Mobile users,IBTimes UK reports, and security researcher Dominic Alvieri told The Register the EndZone dump “appears to be the same original breach.” BYOD denies a formal tie, with a representative telling PCMagthat one member “just knows a few people behind EndZone,”
At launch in June 2025, Eric Trump promised that “Trump Mobile is going to revolutionize cell phones” – but what followed has been less revolutionary.
The “Made in America” promise disappeared from the website within two weeks. Shipping slipped from August 2025 to December, then March, then April, and in April the company rewrote its preorder terms to state that “a deposit is not a purchase.” In January, lawmakers urged the FTC to examine the brand’s marketing.
For consumers, there is a silver lining: No payment card data has been reported in the dump, so the immediate risk is phishing rather than direct fraud. This doesn’t completely solve the problem, however: names, phone numbers, home addresses, and order histories are exactly what scammers need to pose convincingly as a carrier or a delivery service.
Anyone who signed up, or merely started signing up, with Trump Mobile should treat unexpected messages about orders, refunds, or account problems with suspicion at a time when Trump Mobile continues to drag its feet on the matter, much like its May breach, when the company said it was still deciding whether to notify people. This time is a little different, however: it has said nothing at all.
