I'm betting the hack happened. Regardless of a "third party", T-Mobile is ultimately responsible for those they outsource to. Another fact is the company has had one breach after another over the past 3 years. Clearly indicating profits are more important than protection of the data they collect.
https://www.bleepingcomputer.com/news/security/t-mobile-denies-it-was-hacked-links-leaked-data-to-vendor-breach/