he breach was at a unit of the credit agency Experian, which T-Mobile uses to process information on subscribers.
Names, birth dates and social security numbers are among data stolen, but not financial details, the firms said.
Chief executive John Legere said his company would review its link with Experian. "Obviously I am incredibly angry about this data breach," he said.
Subscribers who were credit-checked between 1 September 2013 and 16 September 2015 are most at risk.