BYOD Leaks 3,615 Trump Mobile Records Via Liberty Mobile Employee Device Malware
A cybercrime group published personal data of thousands of Trump Mobile prospects after compromising a Liberty Mobile employee device, citing a lack of security response.
Key points
- Group BYOD leaked data for 3,615 Trump Mobile records including names and addresses.
- Attackers entered via malware on a Liberty Mobile employee device.
- Trump Mobile allegedly stated it had no team to handle the incident.
A cybercrime group calling itself BYOD has published personal information belonging to 3,615 individuals associated with Trump Mobile, according to a report by TechRadar. The dataset includes names, email addresses, home addresses, phone numbers, and order details. Straight Arrow News first reported the leak after reviewing the dataset and contacting people listed in it. This incident marks the third organization targeted by BYOD, a newly formed ransomware-as-a-service operation that posted the data to its dark web site in late September 2026.
The risk
The threat actors claim they gained initial access through malware installed on a device belonging to an employee of Liberty Mobile, the Florida-based operator behind the Trump Mobile service. TechRadar reports that BYOD described the initial compromise as an infostealer, while other outlets like Cybernews and Android Authority characterize the tool as a remote access trojan. Once inside, the group allegedly moved laterally to exposed subdomains related to Trump Mobile. They claim to maintain active access to a customer dashboard, stating that neither Trump Mobile nor Liberty Mobile utilized multi-factor authentication for this system.
View the original post on X
View the original post on X
Who is exposed
The leaked data appears to cover prospective customers of the wireless service rather than buyers of the T1 smartphone, according to TechRadar. The records include abandoned sign-ups and even contain the details of the Trump Organization’s own Chief Information Officer. Straight Arrow News contacted people listed in the file after reviewing the dataset. BYOD provided a screenshot of the customer dashboard to Straight Arrow as proof of access, though independent confirmation of the group’s current ability to log in has not been established.
Cost and compliance
Trump Mobile has not responded to inquiries from Straight Arrow News, and neither the Trump Organization nor Liberty Mobile answered questions from The Register, according to TechRadar. IBTimes UK notes that despite being a ransomware group, BYOD has not published any evidence of encrypted systems or issued a financial ransom demand in connection with this specific leak. The group alleges that Trump Mobile told them there was "no team" to respond to the breach and branded the hackers as terrorists.
What should you do?
Business leaders should immediately verify if any employee devices connected to critical infrastructure are protected by modern endpoint detection and response tools. Organizations must audit subdomain security to ensure external-facing portals are not exposed without multi-factor authentication. Monitoring dark web forums for leaked credentials is essential for early detection of similar breaches.
What to do and how to stay safe: Trump Mobile
- Enforce multi-factor authentication on all customer-facing dashboards and internal administrative portals immediately.
- Conduct a thorough audit of exposed subdomains to identify and close unauthorized access points.
- Monitor dark web leak sites and breach notification services for any appearance of your organization’s data.
- Verify that all employee devices, especially those with remote access capabilities, have up-to-date endpoint security software.
Step-by-step guide: Mobile Security Architecture: 8 Practices for Device Integrity
General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What specific data was stolen from Trump Mobile?
The leaked dataset includes names, email addresses, phone numbers, home addresses, and order details for 3,615 individuals.
How did the hackers gain access to the systems?
The group claims they compromised a Liberty Mobile employee’s device using malware, then pivoted to exposed Trump Mobile subdomains.
Has a ransom demand been issued?
No, IBTimes UK reports that while BYOD is a ransomware group, no ransom demand or encrypted systems have been linked to this leak.
