Customers' info potentially handed to anyone who could send an HTTP request
The US President’s oft-maligned Trump Mobile venture may be facing another setback after a security buff claims he discovered a now-plugged website vulnerability that he says was leaking what could be tens of thousands of suckers' customers' details.
The individual behind the discovery, who goes by "Louis," says he's a self-taught tech tinkerer and described himself as "just a nerd between jobs with too much time on my hands." He reckons the website’s data could be scooped up with a simple POST request.
“It wasn't SQL. That wouldn't be as bad,” he told The Register. “It was a really simple HTTP request. POST, and then just asking for the info I wanted, basically.”
More than 27,000 people who ordered from Trump Mobile, the President’s all-American smartphone and cell service brand, had their data flimsily secured online, Louis claimed.
Louis, a long-serving IT professional who refuses to be called a security researcher, said the types of data he was able to gather included: first and last names, primary addresses, secondary addresses, email addresses, phone numbers, customer/account numbers, "enrollment ID" (pre-order number), and whether the order was placed by phone or online.
“I discovered it first by looking into the site to see if I could find how many orders there actually were, and noticing some API endpoints,” he added. “I tried a couple of basic commands, and then it started showing whatever data I wanted.
“It was as easy as going to the website and writing a very simple HTTP POST request into the console.”
The website flaw only allowed him to return ten customer records at a time, he said, but these records all contained a customer number, which Louis used to loop through them all.
In the space of an hour, the method allowed him to access the records of around 5,000 Trump Mobile customers, he claimed.
After confirming the issue was valid and that all the data his script scooped up was deleted, Louis tried to disclose his findings to Trump Mobile, and anyone else who could take action, but received no response, although someone appears to have fixed the issue.
The Register also tried contacting Trump Mobile but similarly received nothing in return.
Out of options for disclosure, Louis decided to go public, informing two prominent YouTube creators and known orderers of the Trump T1 phone, Stephen “Coffeezilla” Findeisen and Charles “penguinz0” White Jr., whose respective videos covering his findings have jointly gathered millions of views.
Trump T1 begins shipping
Trump Mobile’s flagship device, the T1 Android smartphone with the gold-colored casing, began showing up at pre-order customers’ doors this week, after originally being slated for an August 2025 release.
The brand’s entire schtick since first being announced in June 2025, around the time of a significant escalation in US-China trade war conflict, was that everything was going to be “Made in America.”
Early renders of the proposed T1 showed what appeared to be an iPhone-like device – gold-colored, of course – but those who received their orders this week confirm it is just a reskinned HTC U-24 Pro, a mid-range Android from the Taiwanese tech biz which first hit the market in June 2024.
The American flag embossed on the back of the device also only has 11 stripes instead of 13, although all the stars are present and accounted for, at least.
When the President’s sons launched the Trump Mobile Brand last year, they promised the devices would be manufactured in America, although the company soon dropped this from its marketing.
The T1 comes loaded with 512GB of storage, a 120Hz display, a Snapdragon 7 chip, and, of course, Truth Social pre-installed.
Customers can order now to lock in what the company calls promotional pricing, picking up the T1 for $499. It is not clear what this may rise to in the future. You can pick up a standard HTC U-24 Pro 512GB model for roughly the same price, depending on the retailer. ®