A hacker leveraged an Application Programming Interface (API) to steal the personal information of 37 million customers over two months, undetected, from American cellular carrier T-Mobile. The acknowledgment by the carrier in a filing Thursday with the U.S. Securities and Exchange Commission comes six months after it agreed to settle a class action lawsuit over