T-Mobile must complete the move to zero trust and improve authentication, along with implementing better data minimization and improving asset inventory, said a US Federal Communications Commission (FCC) consent decree that the commission published on Monday.

The settlement stems from a series of FCC investigations focused on three major T-Mobile data breaches in 2021, 2022, and 2023, which impacted millions of its customers. 

It also includes T-Mobile’s agreement to pay a $15.75 million civil penalty, as well as a promise to invest the identical amount over the next two years “to strengthen its cybersecurity program, and develop and implement a compliance plan to protect consumers against similar data breaches in the future.”