Trump Mobile investigating potential exposure of would-be customers’ personal information

A phone company launched by Donald Trump’s family business is investigating a potential security flaw on its website that appears to have exposed the personal details of an estimated 27,000 people who sought to buy a gold-coloured smartphone.

Trump Mobile said in a statement that it was investigating the issue – “with the assistance of independent cybersecurity professionals” – in which the full names, addresses and phone numbers of people who filled out preorder forms appeared to be exposed.

“Based on the available information, we have not identified evidence that Trump Mobile’s systems, infrastructure, or network were directly compromised. The investigation remains ongoing,” the company said in response to questions from the Guardian about the issue.

“At this time, the incident does not appear to involve Trump Mobile payment card information, banking information, Social Security numbers, call records, text messages, or other highly sensitive financial data. At this time, the impacted information appears to be limited to certain customer details, including names, email addresses, mailing addresses, order identifiers and mobile phone numbers.”

The company said additional safeguards and monitoring measures were now in place, and it was “also evaluating any applicable notification obligations”.

Trump Mobile said customers should remain alert for any suspicious emails, calls or text messages regarding their orders, and the company *“*will not ask customers to provide payment information, passwords, or other sensitive information through unsolicited communications”.

The discovery coincided with Trump Mobile beginning to distribute its bespoke T1 smartphones after an almost 10-month delay and an about-face on the company’s initial promise to manufacture the phones in the US.

An Australian programmer – who has been working in IT for nearly 20 years and asked not to be identified out of fear of being the target of personal attacks – told the Guardian they had incidentally discovered the site’s possible security flaws and reported them to Trump Mobile.

Jonathan Soma, a programmer and professor at New York’s Columbia University, reviewed the code that the Australian had uncovered and copied from the Trump Mobile website. Soma said the website used a common e-commerce model, in which every potential order added another “1” to a list, the total of which had reached 27,224 possible pre-orders on the available information.