The vast majority of victims weren’t even T-Mobile customers. Now their information is for sale on the dark web.