T-Mobile is facing criticism for sending abusive letters.

Where did the perpetrator obtain the data?

T-Mobile has been the victim of several data compromises. Most recently, an individual attempted to repackage and sell previously stolen data on a hacking forum. Therefore, it is not shocking that private information is circulating online.

While the FTC advises organizations to have exposed data removed from websites, it is impossible to completely erase the information from the internet.

T-Mobile previously resolved a class-action lawsuit to settle the FCC's investigation into data breaches. This means the company has already compensated for the errors that enabled data leaks to occur.

It is also possible that the source of the information was not T-Mobile. However, because the incident involved data entrusted to the carrier, it should still be held responsible.

T-Mobile should take the incident seriously.

T-Mobile must thoroughly investigate the situation and keep customers informed. The letters sent to customers appeared legitimate, making it improbable that someone went to such lengths simply to cause trouble. Swift action from T-Mobile would prevent further letters from being sent.

This is important not only because the letters are a bother and can cause concern, but also because the initial letter may have been a tactic to influence customers and make them more susceptible to future actions, such as an extortion attempt.