CFIUS Fines T-Mobile $60 Million, Alleging Failure to Protect Data

Telecommunications company T-Mobile was fined $60 million by a U.S. regulator that said the company failed to prevent and report unauthorized access to sensitive data.

The Committee on Foreign Investment in the United States (CFIUS) said in an announcement of the enforcement action that T-Mobile committed these violations between August 2020 and June 2021, and the company’s failure to report some incidents delayed the regulator’s efforts to investigate and mitigate any potential harm.

The violations came after T-Mobile entered into a national security agreement with CFIUS in 2018 due to the company’s merger with Sprint and the foreign ownership of the entity resulting from that merger, according to the announcement.

“CFIUS concluded that these violations resulted in harm to the national security equities of the United States,” the regulator said in the announcement. “T-Mobile has worked with CFIUS to enhance its compliance posture and obligations and has committed to working cooperatively with the U.S. government to ensure compliance with its obligations going forward.”

T-Mobile said, per The Wall Street Journal (WSJ), that the incidents resulted from technical issues during its integration with Sprint, that they involved unauthorized access to information shared from law enforcement requests, and that the information remained within the law enforcement community.

“We reported this in a timely manner, and the issue was quickly addressed,” a T-Mobile spokesperson said, according to the WSJ report. “We are glad to have reached a resolution and look forward to continuing to work cooperatively with the law enforcement community to help keep the country and our customers safe.”

The CFIUS announcement of the enforcement action was made on a website that was unveiled by the Treasury Department Wednesday (Aug. 14) and shares information about civil monetary penalties imposed by CFIUS, according to a press release.

“Today’s penalty updates underscore CFIUS’ commitment to accountability and the protection of national security,” Assistant Secretary of the Treasury for Investment Security Paul Rosen said in the release.

The civil penalty imposed on T-Mobile is the largest ever imposed by CFIUS and is the first enforcement action taken by the regulator that publicly named the targeted company, according to the WSJ report.