I was part of the Anthem BC/BS and Equifax breaches, and had identity theft monitoring as a result of both. It's run out from the Anthem breach, but is still active from the Equifax breach. I imagine I'll end up getting 2 more years as a result of this T-Mobile breach, but that will depend on whether my account was part of it.
I can't say whether T-Mobile was being cavalier or not, because I don't know. But what I do know is that these sorts of breaches are a fact of life and will remain so. Cybersecurity is the ultimate cat and mouse game and no matter how vigilant one may be a dedicated hacker will find a way if the target is juicy enough. It will just take them longer to do it.
A very good article in yesterday's
New York Times on this T-Mobile breach and the one in 2018:
T-Mobile Says Hack Exposed Personal Data of 40 Million People
I froze/locked my credit reporting from not only the "Big Three", Equifax, Transunion, and Experian, but one much smaller agency, Innovis.