The Paris Hilton Phone Hack: How One Phone Call Opened the Door

Hackers & Hooks | Season 1, Episode 2

In 2005, one of the most talked-about phones in America was the T-Mobile Sidekick, and one of its most famous users was Paris Hilton, who had appeared in a Sidekick ad. In February of that year, the contents of her phone ended up on the internet: her contact list, private notes, and personal photos. The phone numbers of other well-known people stored in her contacts spread with it.

In episode two of Hackers & Hooks, Nick Gipson and Isaac Reed look at how it happened. The short version is that it did not take advanced technical skill. It took a confident phone call to the right person. That same trick still works on businesses today, which is why this old celebrity story belongs on every small business owner’s radar.

A Phone Call, Not a Supercomputer

According to Washington Post reporting at the time, which relied largely on the account of one member of the group involved, a teenager called a T-Mobile store and posed as a supervisor from company headquarters. The employee on the line reportedly handed over the address of an internal customer account system, along with a working employee username and password.

With that access, the group could look up customer accounts. They then used a weakness in T-Mobile’s password reset process to take over Hilton’s account. Because Sidekick data was stored on the carrier’s servers, whoever controlled the account could reach everything on it, from anywhere. Within a day, her data was posted online, and news sites picked it up soon after.

A Massachusetts teenager later pleaded guilty in federal court in Boston to juvenile delinquency charges that included the T-Mobile intrusion, and in September 2005 he was sentenced to 11 months in a juvenile detention facility.

“If you can speak the language and you can get past the few gatekeepers, they’ll pretty much give you the keys to the kingdom.”

Nick Gipson, Hackers & Hooks

Isaac described the culture of the time: if you sounded like you belonged, nobody was going to stop you or ask extra questions. The employee was trying to be helpful. The process gave them no reliable way to check who was really calling.

Trust Without Verification, Then and Now

Security people call this social engineering: tricking a person into doing something they should not, rather than breaking the technology directly. It works because most employees want to help, especially when the caller sounds rushed, important, or official.

Three things went wrong in 2005. The store employee had no way to confirm the caller’s identity. Internal access was protected by a single username and password that could be read over the phone. And one account held everything, so taking it over exposed a person’s entire digital life.

Today the stakes are higher, because phones now hold banking apps, email, and the codes we use to prove who we are. An account takeover can mean locked-out employees, fraudulent payments, exposed customer data, and the kind of public embarrassment that follows a business for years.

Nick closed the episode with a modern example. In September 2023, attackers reportedly used information found on LinkedIn to impersonate an MGM Resorts employee in a call to the company’s IT help desk, which then reset the account’s password and multi-factor authentication. MGM estimated the incident’s cost at about $100 million. Nearly two decades after the Sidekick hack, it was the same trick in a different package.

Nick also raised a point many owners miss: cyber insurance is not a substitute for doing the basics up front. Insurers often expect specific controls, such as multi-factor authentication, and if those controls were missing when an incident happened, a claim can become more complicated. Review your policy’s requirements with your broker or insurer before you need it.

“I don’t think we should say trust but verify anymore. I think we should say never trust, always verify.”

Nick Gipson, Hackers & Hooks

Lessons for Small Businesses

• Verify requests through a second channel. If someone calls asking for a password reset, a payment change, or gift cards, hang up and call back on a number you already know. Isaac noted that voices can now be cloned, so a familiar voice is no longer proof on its own.
• Ask your IT provider how they verify callers. Your help desk, whether in-house or an MSP, should have a written process for confirming identity before resetting a password or multi-factor authentication. Ask to see it.
• Use a password manager, not your browser. A dedicated password manager keeps unique passwords in an encrypted vault. Nick cautions against storing everything, including payment cards, in a browser account, because one compromised login can expose all of it.
• Turn on multi-factor authentication everywhere. A second check, like a code from an app, makes a stolen password far less useful to an attacker.
• Lock down your phone account. Ask your carrier about adding an account PIN or extra protection against moving your number to another device. Change voicemail PINs away from 0000, 1234, or your birthday.
• Know what your insurance expects. Confirm which security controls your cyber policy requires, and make sure they are in place.

How Gipson Cyber Helps

Gipson Cyber provides small business cybersecurity services built around people, not just software. Our Business SOCaaS delivers 24×7 monitoring with real human responders who review warning signs like unusual sign-ins and unexpected account changes. We work with the tools you already have and alongside your current IT team or MSP, and we report what we find in clear, plain language.

If an account has already been taken over, our Business DFIR team can help you contain it, preserve evidence, and understand what was affected. If you think you are being hacked right now, go to 800cyber.com.

Your phone carries your business and your personal life. If you want family cybersecurity protection for the people at home, take a look at our family protection option.