T-Mobile is once again being sued for a data breach in 2021.

Washington state is suing T-Mobile for failing to address cybersecurity vulnerabilities that allowed hackers to expose the personal data of 79 million people nationwide. The consumer protection lawsuit filed Monday by Washington Attorney General Bob Ferguson stems from a cyberattack that began in March 2021 and went unnoticed until T-Mobile disclosed the breach in August.

The filing alleges that T-Mobile failed to address certain security vulnerabilities that the company has known about “for years” and failed to properly notify the more than 2 million Washington residents affected by the breach. The lawsuit accuses T-Mobile of downplaying the severity of the breach, which exposed personal information of current, former and potential customers, including names, phone numbers, physical addresses, dates of birth, Social Security numbers and driver’s licenses. ID number.

The filing says the notice T-Mobile issued about the data breach violated consumer protection laws by omitting key information that made it difficult to assess whether people were at risk for identity theft or fraud. The suit also says T-Mobile “did not meet industry standards for cybersecurity” in the years prior to the hack and used “obvious passwords” to protect accounts that had access to consumer information.

“This significant data breach was completely avoidable,” Ferguson said in a statement. “T-Mobile took years to fix key vulnerabilities in its cybersecurity systems, but it failed.”

This isn’t the first time Washington state has taken action against T-Mobile. Ferguson successfully persuaded the company in 2013 to clarify the limits of its “no-contract” wireless service plan.

Ferguson’s latest lawsuit seeks compensation for customers affected by the 2021 breach and a court order to force T-Mobile to bring its cybersecurity practices in line with industry standards while improving transparency and communication about future data breaches. no see. That comes after T-Mobile paid $350 million in 2022 to settle a class-action lawsuit stemming from a 2021 hack and an additional $15.75 million in fines last year over an FCC investigation into repeated cybersecurity incidents. It follows.