What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
T-Mobile agreed to pay the FCC a $15.75 million civil penalty and make a separate $15.75 million cybersecurity investment over two years to resolve investigations into data-breach incidents from 2021, 2022 and 2023. The $31.5 million total is not all a fine: half is required security spending, not a customer compensation fund. The agreement also requires a comprehensive security program. Read the FCC consent decree.
How much is T-Mobile paying the FCC?
The FCC Enforcement Bureau’s consent decree sets out two distinct obligations:
- $15.75 million civil penalty payable under the agreement.
- $15.75 million in additional cybersecurity investment over the following two years.
Together, those amounts equal $31.5 million, but it would be inaccurate to call the entire sum a fine. The second amount is an investment in cybersecurity, not a payment to customers. These terms appear in the FCC consent decree.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Which T-Mobile breaches does the FCC agreement cover?
The decree resolves Enforcement Bureau investigations connected with incidents in 2021, 2022 and 2023. The investigations concerned possible failures to protect customer proprietary information and customer proprietary network information, as well as related security practices and representations. The FCC described the affected population across the investigations as millions of U.S. consumers, but its announcement does not give a precise combined count or counts for each incident. The FCC’s September 30, 2024 announcement summarizes the action.
#1 Best Overall
The 2021 incident has a more specific public account from T-Mobile. In an August 2021 statement, the company said the attack affected millions of current, former and prospective customers, and that some names, addresses, dates of birth, Social Security numbers and driver’s license or other ID information were compromised. T-Mobile said financial and payment information was not exposed in that incident. That description is T-Mobile’s account of the 2021 breach; it should not be assumed to describe the 2022 or 2023 incidents. Read T-Mobile’s August 2021 statement.
What security changes did T-Mobile agree to make?
The decree requires T-Mobile to implement a comprehensive security program. The FCC’s announcement highlights commitments involving foundational security improvements, cyber hygiene, zero-trust architecture and phishing-resistant multifactor authentication. These are forward-looking obligations in a settlement; they do not establish that every vulnerability has been eliminated or guarantee that another breach cannot occur.
The agreement resolves investigations, not a finding that T-Mobile admitted a violation. The decree says the Bureau and T-Mobile “disagree about whether T-Mobile’s network and data security program and policies in place at the relevant times violated any standard of care or regulation then applicable to T-Mobile.” The FCC order was adopted September 27, 2024, and released September 30, 2024.
Does the FCC settlement pay affected customers?
The FCC consent decree describes a civil penalty and required cybersecurity investment; it is not described in the decree as a customer claims fund. A separate class-action settlement relates to the August 2021 attack. T-Mobile’s June 2026 SEC filing says that the class action received final approval in 2023 and that its $350 million fund covered submitted claims, plaintiffs’ legal fees and administration. The filing also reports $150 million spent on data security and related technology in 2022 and 2023 under that class settlement. Those figures belong to the class action, not the FCC agreement. T-Mobile says the class settlement included no admission of liability, wrongdoing or responsibility. See T-Mobile’s June 2026 SEC filing.
Rank #3
FCC agreement vs. the 2021 class-action settlement
| Matter | Authority and incidents | Financial terms | What the money is for |
|---|---|---|---|
| FCC consent decree | FCC Enforcement Bureau investigations tied to 2021, 2022 and 2023 incidents | $15.75 million civil penalty plus $15.75 million cybersecurity investment over two years | Penalty to resolve the FCC matter and additional security spending; not a customer claims fund |
| 2021 class action | Federal multidistrict class litigation tied to the August 2021 attack | T-Mobile reports a $350 million settlement fund and $150 million spent on security technology under the settlement | The fund covered submitted claims, legal fees and administration; the additional reported spending was for data security and related technology |
The two matters have different purposes and cover different processes. The FCC decree also records T-Mobile’s customer base as 119.7 million post-paid and prepaid customers in the United States; that is company scale, not the number affected by the breaches.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
