T-Mobile Opens Up on Its Cybersecurity Transformation in New Report

BELLEVUE, Wash.--(BUSINESS WIRE)--Nov 2, 2026--

T-Mobile US, Inc. (NASDAQ: TMUS):

This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20261102608714/en/

T-Mobile (NASDAQ: TMUS) today published Advancing Cybersecurity at T-Mobile, an inside look at how one of America’s largest wireless providers rebuilt its security program, what held up when that program was tested and where the work goes next.

It’s a story about speed, scale and a willingness to be uncomfortable. Facing relentless pressure from nation-state actors and financially motivated criminals, T-Mobile asked its employees, contractors and partners to change how they work, from how they prove who they are to how they connect to systems. Two things were non-negotiable: customers’ wireless service had to keep working, and stores had to keep opening. Almost everything else was on the table.

“At T-Mobile, protecting customers is fundamental to who we are. Our industry connects families, businesses, first responders and communities every day, so the security of our networks is a responsibility that extends beyond any single company,” said Jeff Simon, EVP & Chief Information Officer, T-Mobile. “With stakes that high, we couldn’t work at the normal pace. The attackers never stop moving, so our teams skipped the pilots and the multi-year rollouts and moved at a speed most companies wouldn’t try. Today, phishing-related credential compromises among our people are down more than 99%. This report shows what it meant to move that fast, and what we learned along the way.”

Inside the report

Over a recent 12-month period, T-Mobile observed a 37% increase in attempted intrusions, even as credential-based attempts decreased 35%, highlighting how quickly adversaries are adjusting their tactics. Customers feel the pressure too: T-Mobile continues to identify hundreds of millions of scam and spam calls every week, and in 2025 saw nearly 50% more scam and spam messages than in 2024. That’s why T-Mobile is sharing the progress and investments behind its cybersecurity program, including:

Advancing Cybersecurity at T-Mobile also highlights T-Mobile’s Bug Bounty program, which has drawn more than 1,400 valid submissions from the global security community. And no one company can tackle these threats alone, so T-Mobile partners with CISA, is a founding member of the C2 ISAC and the CTIA 5G Security Test Bed and shares what it learns to raise the bar across the industry.

“What stands out in this report is the specificity,” said Jason Leigh, Senior Research Manager, IDC. “Many companies merely provide a litany of cybersecurity abbreviations or footnote security in financial filings with minimal detail on specific cybersecurity actions. T-Mobile is elevating the conversation with a level of detail that signals a security program built for operational maturity.”

What comes next

Advancing Cybersecurity at T-Mobile is a marker of T-Mobile’s cybersecurity work, not a final word on it. The report looks ahead to AI-enabled fraud, non-human identities such as AI agents and bots and quantum computing. T-Mobile is already preparing, from adversarial testing of AI systems to a honeypot program that studies attacker techniques.

In a note to T-Mobile employees today, Mark Clancy, SVP, Information Security Officer, thanked team members across the company for embracing the changes and making security a shared mindset. “Ultimately, cybersecurity is about protecting people,” said Clancy. “We pushed to modernize our systems and strengthen how we detect and respond to threats. With tighter collaboration across our teams and partners, our defenses became stronger and our response faster than ever before. There’s no finish line in cybersecurity. The threat landscape will keep evolving, and so will we.”

T-Mobile’s guiding principle is that security must be seamless, equitable and grounded in the needs of the people and businesses the company serves — and it’s fundamental to how T-Mobile builds, operates and continually strengthens America’s Best Network.

Read the full report, Advancing Cybersecurity at T-Mobile on T-Mobile’s Newsroom. To learn more about online safety, cybersecurity and tools for customers, head to T-Mobile’s Trust Center and Privacy Center.

Follow the T-Mobile Newsroom on X and Instagram to catch the latest company updates.

Cybersecurity metrics are based on T-Mobile internal data as described in the report. Cyber threats continue to evolve, and no security measures can prevent all threats or incidents.

About T-Mobile

As the supercharged Un-carrier, T-Mobile US, Inc. (NASDAQ: TMUS) is powered by an award-winning nationwide 5G Advanced network that connects more people, in more places, than ever before. With T-Mobile’s unique value proposition of best network, best value and best experiences, the Un-carrier is redefining connectivity and fueling competition while continuing to drive the next wave of innovation in wireless, broadband and beyond. Headquartered in Bellevue, Wash., T-Mobile provides services through its subsidiaries and operates its flagship brands, T-Mobile, Metro by T-Mobile and Mint Mobile. For more information, visit https://www.t-mobile.com.

Advancing Cybersecurity at T-Mobile also highlights T-Mobile’s Bug Bounty program, which has drawn more than 1,400 valid submissions from the global security community.

T-Mobile published Advancing Cybersecurity at T-Mobile, a report on how the company rebuilt its security program and what that work has delivered. T-Mobile is showing its work, including what’s changed, what’s held up when tested and what’s next — because trust has to be earned and verifiable.

T-Mobile published Advancing Cybersecurity at T-Mobile, a report on how the company rebuilt its security program and what that work has delivered. T-Mobile is showing its work, including what’s changed, what’s held up when tested and what’s next — because trust has to be earned and verifiable.

T-Mobile published Advancing Cybersecurity at T-Mobile, a report on how the company rebuilt its security program and what that work has delivered. T-Mobile is showing its work, including what’s changed, what’s held up when tested and what’s next — because trust has to be earned and verifiable.

KYIV, Ukraine (AP) — Russia bombed an aid distribution center and neighboring shelter in southern Ukraine on Monday, killing 24 people, Ukraine's emergency services agency said.

Ukrainian President Volodymyr Zelenskyy said in a post on X that 10 guided bombs targeted an area that included a school building used to distribute humanitarian aid and a nearby shelter.

“This is further proof that Russia wants no de-escalation,” Zelenskyy said.

The attacks in the village of Komyshuvakha, in the southern Zaporizhzhia region, occurred as a limited ceasefire expired Monday in Kherson, a different region in the country's south. The limited ceasefire agreement had allowed humanitarian aid and evacuation missions into front-line areas in Russian-occupied territory.

“There was a moment when the next steps could have shown that progress toward peace was possible,” Zelenskyy said. “With these killings, Russia is sending an entirely opposite signal: Russia is counting on more killings.”

Ukrainian authorities also reported Monday multiple Russian drone attacks that injured at least 17 people.

Earlier, residents of Ukraine and Russia had received phony emergency alerts from government-run mobile apps that were hacked, authorities in both countries said. The phony alerts in Ukraine included a warning about an imminent nuclear threat.

It was not clear if the cyber attacks late Sunday in Ukraine and early Monday in Russia were related. Ukraine said its mobile app, which residents rely on to seek safety from Russian missile and drone strikes, was up and running again after being temporarily suspended. Russian authorities said efforts to restore its emergency alert mobile app were ongoing.

A Russian Telegram channel with links to the country's security services said Monday that a hacking group, Hitcore, claimed responsibility for the breach of the Ukrainian emergency alert system. The Associated Press did not independently verify the claim, and the identities, affiliations or motivations of the purported hackers remained unclear.

The alerts received by Ukrainians — making false claims of high radiation levels, a chemical threat and public disturbances in Kyiv — were written in English, Russian and Ukrainian. The English language alerts contained spelling and grammatical errors.

One of the messages, written in Russian, said: “Hi! There will be a nuclear threat across Ukraine. Do not worry, the Oreshnik is incoming,” a reference to a Russian ballistic missile.

There was little indication the fake alerts caused panic in Ukraine. Instead, there was a flood of humorous posts online, with social media users sharing photos of their pets relaxing and apocalypse-themed images generated by artificial intelligence. A photo shared of Kyiv Mayor Vitali Klitschko, a former international kickboxing champion, included the message: “It’s a good thing we have a boxer for a mayor.”

In a Telegram post late Sunday following the breach, Ukraine’s air raid alert channel said “unauthorized parties” had interfered with the app’s operation and warned users not to click on links in “suspicious notifications.”

Ukraine's state-run Center for Countering Disinformation urged people to monitor other emergency channels on social media while the cyberattack was being addressed.

A spokesman for Ukraine’s air force command, Yurii Ihnat, said in a television interview that the cyberattack had no impact on Ukraine’s security and defense operations.

In a statement, Russia’s Emergency Situations Ministry said hackers sent a false alert through its app at approximately 2:45 a.m. Moscow time on Monday across 33 of Russia’s 89 regions. It did not say who it believed carried out the attack.

The ministry said that the digital vulnerability exploited by the attackers had been identified and that “necessary measures” were being taken to prevent a similar breach. It also reassured Russians that the wider public alert system was working normally through SMS messages, media broadcasts and municipal sirens and loudspeakers.

Kremlin spokesperson Dmitry Peskov said all of Russia’s state agencies were under the constant threat of cyberattacks, including a growing number that use artificial intelligence.

“All government bodies must take steps to improve the cybersecurity of our digital resources,” Peskov said.

As the ceasefire in Ukraine's Kherson region came to an end on Monday, Ukraine’s general staff said that Russia’s military had used the pause in fighting to bolster its drone defenses and replenish ammunition supplies.

The brief pause in fighting, which began on Oct. 27, was part of a humanitarian aid and evacuation mission in the Russian-occupied city of Oleshky, and marked the most significant truce between Kyiv and Moscow since Russia’s full-scale invasion began nearly five years ago.

Speaking to reporters in Kyiv on Monday — before the deadly bombings in the Zaporizhzhia region — Ukraine’s ombudsman and lead civilian negotiator for the mission, Dmytro Lubinets, said he hoped the localized ceasefire and evacuation would act as a “model” for other such efforts.

Elsewhere in Ukraine, emergency services reported that drone strikes injured 12 people in the eastern Kharkiv region and damaged a refrigeration facility, greenhouses and residential buildings.

Five people were also reported injured in the Black Sea port city of Odesa, where a warehouse was targeted and homes were damaged.

Russia’s Ministry of Defense said Monday that it shot down 212 Ukrainian drones overnight. The head of Russia’s Samara region, Gov. Vyacheslav Fedorishchev, said in a statement that local air defenses were repelling an aerial attack, but did not give further details.

Independent Russian media outlets later reported that Ukrainian drones had targeted one of Europe’s largest oil transport hubs in Samara.

Katie Marie Davies contributed to this report from Manchester, England.

Follow the AP’s coverage of the war in Ukraine at https://apnews.com/hub/russia-ukraine

This screenshot made on a smartphone shows a series of false alerts received late Sunday, Nov. 1, 2026 from an emergency alert mobile application that was subject to a cyberattack, in Kyiv, Ukraine. Third message in Russian reads "Hi! There will be a nuclear threat across Ukraine. Do not worry, the Oreshnik is incoming. Telegram channel: [link]", Fifth and sixth messages in Ukrainian read "Increased danger, Go to the shelter". (AP Photo) Photo taken with a smartphone.

St. Andrew's Cathedral in Russian-occupied Nova Kakhovka, is seen across the Dnipro River from the village of Kozatske, during a localized ceasefire linked to a humanitarian aid mission to Oleshky, Kherson region, Ukraine, Saturday, Oct. 31, 2026. (AP Photo/Evgeniy Maloletka)

A representative of the Nova Kakhovka administration walks past an unexploded Russian FPV drone during a localized ceasefire linked to a humanitarian aid mission to Oleshky, in the village of Kozatske, Kherson region, Ukraine, Saturday, Oct. 31, 2026. (AP Photo/Evgeniy Maloletka)

Oleh Tarabaka, head of the Nova Kakhovka military administration, left, and Vadym, a Ukrainian sergeant of the 42nd Marine Brigade, right, help evacuate Antonina, a local resident, as they walk past a destroyed residential building in an area contaminated with anti-personnel mines, during a localized ceasefire linked to a humanitarian aid mission to Oleshky, in the village of Kozatske, Kherson region, Ukraine, Saturday, Oct. 31, 2026. (AP Photo/Evgeniy Maloletka)

Rescue workers pull a family from the rubble of a residential building destroyed by a Russian airstrike in Zaporizhzhia, Ukraine, Saturday, Oct. 10, 2026. (AP Photo/Kateryna Klochko)