(Credit: Trump Mobile)
UPDATE: The bug in the Trump Mobile site has now been fixed, according to Coffeezilla.
Trump Mobile also told PCMag it's launched an investigation, and so far uncovered no evidence that the company's systems or network were compromised.
"At this time, the impacted information appears to be limited to certain customer details, including names, email addresses, mailing addresses, order identifiers and mobile phone numbers. Out of an abundance of caution, our third-party platform provider has implemented additional safeguards and enhanced monitoring measures while the matter continues to be investigated with the assistance of independent cybersecurity professionals. We are also evaluating any applicable notification obligations."
"Customers should remain alert for suspicious emails, text messages, or phone calls referencing Trump Mobile orders or accounts. Trump Mobile will not ask customers to provide payment information, passwords, or other sensitive information through unsolicited communications," the company added.
"Trump Mobile remains committed to protecting customer privacy and security and we will provide updates as appropriate."
Original story:
Customers enduring the long wait for their T1 phone from Trump Mobile might have also had their personal data exposed on the carrier’s website.
TrumpMobile.com apparently contains an exploitable software flaw that can leak data, including emails, physical addresses, and full names, according to YouTubers Coffeezilla and Cr1TiKaL.
The duo flagged the problem on Tuesday after a viewer reached out. “Long story short, I found a vulnerability in the Trump T1 Mobile preorder website and gained the ability to both place fake orders, but also to scrape and search the entire preorder database,” the person told Coffeezilla.
The unnamed individual contacted the YouTubers to warn them about the leak since both had preordered the T1 phone, a product that has faced numerous delays since it was introduced a year ago. “I'm just trying to stop people getting doxxed and the f***** authorities are doing nothing,” they told Coffeezilla. “I watch your stuff on YouTube every so often and you mentioned you ordered one. I checked to see if your information was on this list and it is.”
No credit card information was exposed. But the security hole creates a way to view the number of Trump Mobile users, which suggests it only has about 10,000 unique customers. Total online phone orders are at about 30,000, far lower than the estimated 600,000 figure some media outlets have cited for the T1 phone.
Coffeezilla and Cr1TiKaL published videos calling out the problem after receiving no response from the Trump Mobile team. “There’s a public interest in letting people know: Do not order on TrumpMobile.com unless you’re ready for your information to be leaked. It’s basically that bad,” Coffeezilla said.
“The Trump Mobile, the T1 device, is like the mummy’s curse: It brings nothing but misery and plague,” remarked Cr1TiKaL.
Trump Mobile’s press contact didn’t immediately respond to a request for comment. But the company’s customer support told PCMag it was aware of the issue and working on a fix, although no timeline was provided.
In the meantime, Trump Mobile claimed last week that it had started shipping the T1 phone, following growing scam accusations from users who preordered. US Sen. Mark Warner (D-Va.) also sent a letter to the company’s CEO on Tuesday, raising concerns about its business practices, including the T1 delays and dumping its marketing for an American-made phone.
“The cavalier manner in which Trump Mobile has treated its customers is shocking. Buyers of your phones and mobile service should expect that their contracts will be honored in full and not under the cloud of deceptive practice,” Warner wrote.