A ransomware-as-a-service operation calling itself BYOD has posted what it says are 3,615 Trump Mobile customer records, claiming it reached the carrier through an employee at its network partner Liberty Mobile, The Register reported Tuesday. Trump Mobile is the third victim the group has listed.

What Happened

The leaked records include customers' names, email addresses, phone numbers, home addresses and order details, according to The Register.

BYOD says it infected a Liberty Mobile employee's computer with infostealer malware, which harvests saved passwords and session data, and then used that access to get into Trump Mobile's systems through the two companies' business relationship. Trump Mobile operates as a mobile virtual network operator, or MVNO, selling service that runs on a partner's network. The group also claims that neither Liberty Mobile nor Trump Mobile used multifactor authentication.

RelatedCybersecurity Incident at BAE Systems Halts Notices From U.S. Bankruptcy Courts

In its post, BYOD said that when it contacted Trump Mobile, the company replied that it had no team to deal with the matter and that anyone who hacks it is a terrorist. Those statements come from the attackers and have not been confirmed by the company.

The dump contains information on a Trump Organization vice president responsible for information security, The Register said. No data on members of the Trump family appeared in the files.

One customer whose record appears in the leak told The Register they paid a $100 deposit for the gold T1 phone last year and never received the device.

The Trump Organization and Liberty Mobile did not respond to The Register's requests for comment.

Why It Matters

The claimed route into Trump Mobile shows a common weakness in MVNO arrangements. A branded carrier often relies on a partner for network access, billing or customer systems, so a compromised account at the partner can expose the brand's customers. If BYOD's account is accurate, a single infected employee machine and the absence of multifactor authentication were enough to reach customer data.

Infostealer malware has become a routine starting point for breaches because stolen credentials and browser session tokens can let attackers log in as a legitimate user. Multifactor authentication does not stop every such attack, but it removes the easiest path of reusing a stolen password.

The leaked fields are also well suited to phishing. Names, home addresses and order histories let scammers write convincing messages about deliveries, refunds or account problems, particularly to customers still waiting on phone orders.

Competing Claims and Earlier Problems

BYOD is not the first group to claim the breach. A different crew, EndZone, said it had hacked Trump Mobile a week earlier. Security researcher Dominic Alvieri told The Register the two claims appear to stem from the same original breach.

The carrier has had security trouble before. In May 2026, a flaw in its website let outsiders pull customer details by sending simple POST requests, The Register reported.

What to Watch

Trump Mobile has not confirmed the breach or said whether it has notified customers. Customers whose details appear in the files have no official word yet on what was taken or what steps to take. Further leaks from BYOD or EndZone, and any statement from Liberty Mobile about its own systems, would help show how far the intrusion reached.