T-Mobile's third major customer data leak in two years resulted in the exposure of personal information of more than 54 million of the company's customers. The American hacker who is claiming responsibility for the attack told the Wall Street Journal that T-Mobile's "awful" security helped him gain access to millions of customer records.

John Binns, who currently resides in Turkey, said he broke into T-Mobile's servers around August 4. He said he breached the company's network after discovering an unprotected router, which he used to access T-Mobile's data center in Washington state. He was able to access everything from birthdays to social security numbers through the breach, including customers' unique phone-linked IMEI and IMSI numbers.

Last week T-Mobile said their investigation into the breach with the FCC is ongoing, but that the company is confident it has closed off the access point used in the attack. T-Mobile is offering two years of free identity protection services through McAfee's ID Theft Protection Service to those impacted by the breach.

"As we support our customers, we have worked diligently to enhance security across our platforms and are collaborating with industry-leading experts to understand additional immediate and longer-term next steps," said the company in a statement. "We also remain committed to transparency as this investigation continues and will continue to provide updates if new information becomes available that impacts those affected or causes the details above to change or evolve."

The breach highlights the precarious position of many large and well-known companies vulnerable to network data breaches. In May, President Biden signed  a cybersecurity executive order focused on beefing up U.S. cyber protections, threat intelligence sharing and cyberattack response efforts. It specifically focuses on IT service providers, MSPs and MSSPs that work with the U.S. federal government.

T-Mobile has undergone six additional data breaches in the past four years.