Update: In a statement to Android Authority, T-Mobile denied that there was a data breach, saying:
We did not have a systems breach. We continue to investigate these messages that are being sent to solicit illegal activity. We understand other wireless providers have reported similar messages.