It was experian's fault but it was also T-Mobile's fault for not making sure that experian was actually safe from attacks
Experian is one of the big 3 credit report companies, this is kinda odd to say since there's only 2 other options for them with no REAL way to "test" to make sure they're safe.
Oddly enough I guess they have separate units for T-Mobile and their normal data stuff.