Security researchers at KrebsOnSecurity have unveiled threat actor communications claiming that Lapsus$ compromised T-Mobile several times throughout March 2022. Lapsus$ actors claim they have exfiltrated T-Mobile source code for a variety of company projects but did not target any customers of the mobile phone carrier. Historically, Lapsus$ is one of the key threat groups known for data extortion, holding stolen data for ransoms of various amounts. Recently, the group was found to be exfiltrating data and source code from major technology corporations including NVIDIA, Microsoft, and Samsung. Conversations between threat actors reveal that Lapsus$ will often purchase compromised company systems on Russian-affiliated dark web marketplaces prior to their attacks. Lapsus$ members continuously targeted T-Mobile employees with malicious campaigns to gain access to internal company tools and execute hassle-free SIM swap attacks, changing the mobile device number that controlled device access. With successful intrusion, Lapsus$ actors were able to intercept text messages and phone calls, as well as password reset links and multi-factor authentication one-time-passwords. This access allowed Lapsus$ threat actors to successfully exfiltrate data from T-Mobile systems and hold it for an undisclosed ransom. CTIX will continue to monitor the fallout of this compromise and will provide additional information as it becomes available.