T-Mobile violated WA data breach notification law, judge rules
A King County Superior Court judge ruled that T-Mobile violated Washington State's data breach notification law after a breach exposed sensitive personal information belonging to 40 million people, with the stolen data later sold on the dark web. The case was brought by Washington's attorney general in January 2025.
Why this matters: Forty million people had their data stolen and sold, and T-Mobile did not tell them the way the law requires. That is the core of it. Notification laws exist for a simple reason: people deserve a chance to protect themselves after a breach. If you do not hear about it quickly, you cannot freeze your credit, change passwords, or watch for fraud. A judge deciding a major carrier broke that rule is accountability worth paying attention to. The penalty phase will say a lot about whether these laws have real teeth.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance · General readers · Policy
This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.