Experian North America  today announced that one of its business units, notably not  its consumer credit bureau, experienced an unauthorized acquisition of information from a server that contained data on behalf of one of its clients, T-Mobile, USA, Inc.

The data included some personally identifiable information for approximately 15 million consumers in the US, including those who applied for T-Mobile USA postpaid services or device financing from September 1, 2013 through September 16, 2015, based on Experian’s investigation to date.  This incident did not impact Experian’s consumer credit database.

Upon discovery of the incident, Experian took immediate action, including securing the server, initiating a comprehensive investigation, and notifying U.S. and international law enforcement.

The data acquired included names, dates of birth, addresses, and Social Security numbers and/or an alternative form of ID like a drivers’ license number, as well as additional information used in T-Mobile’s own credit assessment.  No payment card or banking information was acquired.

Experian is in the process of notifying consumers that may be affected, and safeguarding their identity and personal information by offering two years of credit monitoring and identity resolution services through ProtectMyID.  To find additional information, go to www.experian.com/T-MobileFacts.  Although there is no evidence to-date that the data has been used inappropriately, Experian strongly encourages affected consumers to enroll in the complimentary identity resolution services.  Affected consumers may enroll in free credit monitoring services at www.protectmyid.com/securityincident.

“We take privacy very seriously and we understand that this news is both stressful and frustrating.  We sincerely apologize for the concern and stress that this event may cause,” said Craig Boundy, Chief Executive Officer, Experian North America. “That is why we’re taking steps to provide protection and support to those affected by this incident and will continue to coordinate with law enforcement during its investigation.”

Consumers should note that under no circumstances will Experian or T-Mobile call you or send you a message and ask for your personal information in connection with this incident.  You may go to the website, but you should not provide personal information to anyone who calls you or sends you a message about this incident.