Hackers accessed the social security numbers, birthdates and other personal information belonging to about 15 million T-Mobile wireless customers and applicants, credit reporting agency Experian said on October 1.
The breach was at a unit of Experian, which T-Mobile uses to process information on subscribers.
Experian said T-Mobile customers who applied for wireless service between September 1, 2013 and September 16, 2015 may have had their information stolen.
Names, birth dates and social security numbers are among data stolen, but not financial details, the companies said.
T-Mobile CEO John Legere said his company would review its link with Experian.
In a statement, John Legere said: “I take our customer and prospective customer privacy very seriously. This is no small issue for us.
“I do want to assure our customers that neither T-Mobile’s systems nor network were part of this intrusion and this did not involve any payment card numbers or bank account information.
“Experian has assured us that they have taken aggressive steps to improve the protection of their system and of our data.”
Experian North America chief executive Craig Boundy said in his own statement: “We sincerely apologize for the concern and stress that this event may cause.”
It was unclear when the breach was discovered, but Experian said the matter was reported to the authorities immediately after it learned of the hack.
Experian said in a statement: “We continue to investigate the theft, closely monitor our systems, and work with domestic and international law enforcement. Investigation of the incident is ongoing.
“Experian is notifying the individuals who may have been affected and is offering free credit monitoring and identity resolution services for two years. In addition, government agencies are being notified as required by law.”
Experian said there “is no evidence that the data has been used inappropriately”.
There have been a string of high-profile hacks of businesses and other organizations in recent years affecting millions of people, including adultery website Ashley Madison, Sony Pictures, and retailers such as Home Depot, Target, and eBay.
T-Mobile is now the third biggest mobile company in the US, having surpassed Sprint this year.