Trump Mobile Website Exposes Customer Data Due to Vulnerability

Severity: High (Score: 66.0)

Sources: Theregister, Techcrunch

Published: 2026-05-22 · Updated: 2026-05-22

Keywords: trump, mobile, leaking, claims, website, data, president

Summary

A security researcher identified a vulnerability on the Trump Mobile website that exposed personal data of over 27,000 customers, including names, addresses, and email addresses. The researcher, known as Louis, used a simple HTTP POST request to access the data, which he confirmed was deleted after discovery. Despite attempts to notify Trump Mobile, he received no response, prompting him to go public through YouTube creators Coffeezilla and penguinz0. The incident highlights significant security flaws in the Trump Mobile platform, which has faced scrutiny since its launch. The company has not addressed the issue publicly, and the data remains accessible online. The flagship T1 smartphone was recently shipped to customers, raising concerns about the security of their personal information. Key Points: • Over 27,000 Trump Mobile customers had their personal data exposed due to a website vulnerability. • The vulnerability was exploited using a simple HTTP POST request, allowing access to sensitive information. • Trump Mobile has not responded to disclosure attempts, leaving customer data potentially at risk.

Detailed Analysis

**Impact** Over 27,000 Trump Mobile customers had their personal data exposed, including first and last names, mailing addresses, email addresses, phone numbers, customer/account numbers, and enrollment IDs. The affected individuals are primarily US-based consumers who pre-ordered the T1 smartphone. The leak compromises customer privacy and could lead to identity theft, targeted phishing, or fraud. The breach affects the telecommunications and consumer electronics sectors. **Technical Details** The vulnerability was exploited via a simple HTTP POST request to an unsecured API endpoint, allowing unauthorized access to customer records in batches of ten. The attacker automated requests using customer numbers to enumerate approximately 5,000 records within an hour. No malware or CVEs were reported; the issue stems from insecure API design and lack of proper access controls. The attack occurred at the data access stage of the kill chain. No specific IOCs were provided. **Recommended Response** Immediate remediation should include securing API endpoints with proper authentication and authorization controls to prevent unauthorized data access. Implement rate limiting and input validation on all customer data queries. Monitor for unusual POST request patterns targeting customer data APIs. Since no patches or IOCs are available, defenders should audit web application security configurations and verify that all customer data endpoints are inaccessible without valid credentials.

Source articles (3)

• Techie claims Trump Mobile website was leaking thousands of people's data — Theregister · 2026-05-22
  The US President’s oft-maligned Trump Mobile venture may be facing another setback after a security buff claims he discovered a now-plugged website vulnerability that he says was leaking what could be…
• Trump Mobile confirms it exposed customers’ personal data, including phone numbers and home addresses — Techcrunch · 2026-05-22
  Phone provider Trump Mobile has confirmed that it was exposing customers’ names, email addresses, mailing addresses, cell numbers, and order identifiers to the open internet. Chris Walker, a spokesper…
• Customers say Trump Mobile is leaking their personal information — Techcrunch · 2026-05-20
  President Trump’s namesake cellphone provider and smartphone maker Trump Mobile is leaking customer data, including mailing addresses and email addresses, according to reports. On Tuesday, YouTubers C…

Timeline

• 2026-05-20 — YouTubers report data leak: Coffeezilla and penguinz0 revealed they were alerted to a data leak affecting Trump Mobile customers, including their own information.
• 2026-05-22 — Researcher discloses vulnerability: Louis, a self-taught tech enthusiast, publicly disclosed a vulnerability on the Trump Mobile website that leaked customer data.
• 2026-05-22 — Trump Mobile's T1 phone ships: The T1 smartphone began shipping to customers, coinciding with the revelation of the data leak.

Related entities

• Data Breach (Attack Type)
• Trump Mobile (Company)
• CWE-200 - Exposure of Sensitive Information (Cwe)
• for.us (Domain)
• trumpmobile.com (Domain)
• Android (Platform)