A court in Washington state has found that T-Mobile broke state law in the way it handled a data breach. A King County Superior Court judge ruled that the wireless carrier violated Washington law by failing to properly notify customers whose information was exposed. The decision marks a significant setback for the Bellevue-based company, placing the focus not on whether a breach occurred, but on how the company communicated it to the people affected. It also underscores how seriously state authorities are treating the rules around breach notification.
The ruling stems from a lawsuit brought by the state. Washington's Attorney General's office filed the case back in January of 2025, taking the carrier to court over its conduct surrounding the breach. The lawsuit put T-Mobile's handling of customer data and its response to the incident under legal scrutiny, arguing that the company fell short of what state law requires. The case has now produced a ruling that sides with the state's central claims about how the breach was handled and disclosed to the public.
At the heart of the case is a data breach that dates back to 2021. According to the lawsuit, T-Mobile did not do enough to secure account information belonging to more than 2 million customers in Washington during that breach. In other words, the state argued that the exposure of sensitive customer data could and should have been better guarded against. The scale of the breach, which affected millions of state residents, is part of what made the case a priority for Washington authorities.
Beyond the security lapse itself, the lawsuit also alleged that T-Mobile failed to properly notify the customers who were affected by the breach. This question of notification became central to the judge's ruling. Specifically, the court found that the company's approach of sending text messages to inform customers about the breach does not count as proper notification under Washington state law. In effect, the judge concluded that a text alert was not enough to satisfy the legal standard for telling people that their data had been exposed.
T-Mobile pushed back on the decision. In response to the ruling, the company said that its notification strategy had been designed to reach customers quickly and effectively, defending the use of text messages as a fast way to get the word out. The carrier also made clear that it does not intend to accept the ruling as the final word, saying it will challenge the court's decision. That signals the legal dispute is likely to continue for some time rather than end with this ruling.
The case highlights the growing legal weight attached to how companies tell customers about data breaches, not just how they try to prevent them. For a large carrier based in Washington, a ruling that its chosen method of notification fell short of the law could carry broader implications for how such incidents are handled in the future. As the company prepares to challenge the decision, the outcome may help shape expectations for what counts as adequate breach notification for millions of customers in the state.