Judge Rules T-Mobile Violated Washington State Data Breach Notification Law

A King County Superior Court judge ruled that T-Mobile violated Washington state’s data breach notification law by failing to properly notify customers of a breach affecting 40 million individuals. The stolen sensitive personal information was sold on the dark web, prompting a civil lawsuit filed by the Washington attorney general’s office in January 2025. The case centers on T-Mobile’s alleged inadequate disclosure of the breach’s scope and impact. No specific technical details or CVE identifiers were mentioned in the ruling. The legal action targets the Bellevue-based company for non-compliance with state notification requirements.