Experian

Experian, one of the three major US credit bureaus, was hit by a data breach discovered on September 15, 2015, in which an attacker gained unauthorized access to a server holding personal information on consumers who had applied for T-Mobile services and device financing. According to a multi-state Attorneys General assurance, the incident affected roughly 15 million people. Separately, our investigation team has indexed a much larger dataset attributed to Experian, dated September 16, 2015, containing about 110 million records with extensive demographic and financial details. No hacking group has claimed that dataset, and its exact source remains inconclusive; some individuals have confirmed portions of their own data in it, but its origin has not been independently verified.

Limited public reporting: As of September 25, 2026, detailed company notices or major news coverage for this listing were limited in sources reviewed. The facts below rely primarily on the indexed fields plus any secondary sources cited.

September 15, 2015: Experian discovered unauthorized access to a server storing data on T-Mobile credit applicants, according to a settlement assurance filed with state Attorneys General.

October 1, 2015: Experian and T-Mobile publicly announced the breach, which affected applicants who required credit checks between September 1, 2013 and September 16, 2015.

What Information Was Compromised?

Our analysis found the following data types in this breach: name (about 110.2 million records), home address and phone number (about 110.2 million each), religion (about 102.8 million), job and job salary (about 102.2 million and 104.2 million respectively), net worth (about 99 million), credit score (about 96.9 million), ethnic group and ethnic country fields (about 103 million each), education level (about 60.6 million), number of children (about 46.9 million), and a wide range of household attributes such as home ownership, home type, year built, number of adults and children in the home, home value indicators, pool ownership, heating fuel, water and sewer type, and veteran status.

Experian's notice and T-Mobile's public letter also listed names, addresses, birth dates, and encrypted fields containing Social Security numbers and government ID numbers such as driver's license or passport numbers, and stated that the encryption may have been compromised.

Not every individual is affected by every type of data listed here.

What Are the Potential Risks for Affected Individuals?

The confirmed exposure of Social Security numbers and government ID numbers carries a serious risk of identity theft, since criminals can use that data to open accounts, file fraudulent tax returns, or impersonate victims. The demographic and financial fields add a second risk: detailed profiles covering religion, salary, net worth, credit standing, and family composition are well suited to convincing targeted phishing and social engineering, because scammers can reference plausible personal details to appear legitimate. Because this dataset surfaced without a verified source and has never been fully accounted for, it is difficult to know where copies may exist or who holds them today.