Trump Mobile leak exposed 3,615 customers' data via its carrier's employee, hackers say

On 6 October 2026, The Verge reported that Trump Mobile, the Trump Organization's phone service, appeared to have suffered a data breach exposing the data of 3,615 people, citing reports by PCMag and Straight Arrow News. The leaked dataset reportedly included names, home addresses, emails, phone numbers and order information, and PCMag and Straight Arrow News contacted several people in it who confirmed the information was accurate.

A hacking group calling itself BYOD claimed responsibility. One member told PCMag the group breached the phone service by installing a remote access trojan on an employee of Liberty Mobile — the carrier that powers Trump Mobile's network — and the group also claims access to the backend of Trump Mobile's website, according to Straight Arrow News.

The exposure extended beyond confirmed customers: one person in the dataset told PCMag they never managed to finish setting up their account, yet the email address and phone number they had given the company still leaked. The data also reportedly included Eric Brunnett, chief information technology officer at The Trump Organization. The Verge reached out to Trump Mobile for comment and did not immediately hear back.

Personal data of 3,615 customers and would-be customers leaked: names, home addresses, emails, phone numbers and order information.

Trump Mobile runs as an MVNO on Liberty Mobile's network, so its customer records sat on infrastructure whose endpoints it does not operate.

The reported entry point was a single carrier employee's machine, not a headline-grabbing zero-day — ordinary endpoint compromise was enough.

The signup funnel apparently retained contact details from people who never completed enrollment, widening the blast radius to prospects as well as customers.

Senior internal figures' records were in the dataset too, suggesting internal contact data lived in the same exposed systems.

An MVNO's security is its carrier's security: your customer data sits on someone else's network, and one compromised employee machine is your breach.

The Verge received no immediate comment from Trump Mobile. BYOD claimed continued access to the website backend at the time of reporting. No regulator action, notification count or remediation was reported in the source.