Trump Mobile, the phone company launched by Donald Trump’s family business, is investigating a potential security flaw on its website that appears to have exposed the personal details of an estimated 27,000 people who sought to buy a gold-coloured smartphone.
The company said it was investigating the issue “with the assistance of independent cybersecurity professionals” after full names, addresses and phone numbers of people who filled out preorder forms appeared to be exposed. In a statement, Trump Mobile said it had not identified evidence that its systems, infrastructure or network were “directly compromised”, and the incident did not appear to involve payment card information, banking information, Social Security numbers, call records, text messages or other highly sensitive financial data.
The affected information appears to be limited to certain customer details, including names, email addresses, mailing addresses, order identifiers and mobile phone numbers. The company said additional safeguards and monitoring measures were now in place, and it was evaluating any applicable notification obligations.
The discovery was made by an Australian programmer with nearly 20 years of IT experience, who reported the issue to Trump Mobile. Jonathan Soma, a programmer and professor at Columbia University in New York, reviewed the code and said the website used a common e-commerce model in which every potential order added another “1” to a list, with the total reaching 27,224 possible pre-orders. However, he noted that the code reflected the last step before payment, meaning those who abandoned their carts were also recorded in the data.
The news comes as Trump Mobile begins distributing its T1 smartphones after a delay of almost 10 months and a reversal of its initial promise to manufacture the phones in the US. The company’s chief executive, Pat O’Brien, said the first T1 phones were assembled in the US and would use components “primarily manufactured” locally. He declined to confirm the number of preorders but told USA Today that Trump Mobile was “incredibly pleased” with interest in its products.
Trump Mobile advised customers to remain alert for suspicious emails, calls or text messages regarding their orders, stating that the company “will not ask customers to provide payment information, passwords, or other sensitive information through unsolicited communications.”
