Hackers claim to have hit thousands of Trump Phone customers as the bad news for golden smartphone fans continues

Cybercrime group BYOD has published records on 3,615 Trump Mobile customers, including names, home addresses, phone numbers, and order details BYOD says it got in via malware on a Liberty Mobile employee's device, and that Trump Mobile told it there was "no team" to respond The published data appears to cover the wireless service rather than T1 phone orders, and includes abandoned sign-ups and the Trump Organization's own CIO A newly formed cybercrime group calling itself BYOD says it has stolen and published personal data belonging to 3,615 Trump Mobile customers, the latest setback for the Trump-branded wireless venture and its gold-colored T1 smartphone.

Straight Arrow News first reported the leak after reviewing the dataset, which contains names, email addresses, phone numbers, home addresses, and order details, and contacting people listed in it.

Trump Mobile has not responded to Straight Arrow , and neither the Trump Organization nor Liberty Mobile, the Florida-based operator behind the service, answered questions from The Register .

A ransom note that skipped the ransom component BYOD posted the data to its dark web leak site in late September 2026; a ransomware tracker cited by IBTimes UK dates the entry to September 29.

The Register describes BYOD as a new ransomware-as-a-service operation, with Trump Mobile as only the third organization named on its site, though IBTimes UK notes that nothing published so far shows encrypted systems or a ransom demand.

The group's account of how it got in is consistent in outline, even if the details differ slightly: BYOD told International Cyber Digest it compromised a Liberty Mobile employee with an infostealer, while Cybernews and Android Authority describe a remote access trojan.

Regardless of how they got onto the device, BYOD's messaging indicates it pivoted from that foothold to exposed Trump Mobile subdomains, still has live access to a customer dashboard, and claims neither company used multi-factor authentication.

As proof, it sent Straight Arrow a dashboard screenshot showing one customer's personal details, but said access has not been independently confirmed yet.

The more damning part of this is that Trump Mobile's answer to this has been "We have no team to handle this" and branding anyone who hacked it a terrorist, an exchange that BYOD alleges took place.

The data, however, has held up; Straight Arrow reached people who confirmed their details were accurate, Cybernews said its samples looked genuine and did not match earlier breaches, and PCMag reached three people in the file, one of whom was surprised to find an accurate record of canceling a 30-day unlimited plan.