As if T-Mobile needs another PR nightmare. Fresh off a widespread service disruption that left at least 5 percent of its users without voice, text and data services, not to mention the Sidekick data debacle, comes news that T-Mobile employees in the U.K. sold “millions of records from thousands of customers” to third-party data brokers, per BBC News.

T-Mobile told BBC News that the employees sold the data—mostly about customers whose contracts were nearing completion—without the company’s knowledge; data brokers bought the info, then sold it to other companies that would cold call the customers as their contracts were set to expire. Christopher Graham, the U.K.‘s newly-appointed Information Commissioner, dubbed it “the biggest” data breach of its kind.

T-Mobile first reported its suspicions about the illegal data-trading to Graham’s agency, which then obtained search warrants and interviewed various employees. The office is prepping to prosecute the as-yet-unnamed offenders, with Graham making the case that the current penalties for these kinds of offenses—fines, but not jail time—aren’t severe enough to deter people from selling data in the first place. No word on how or whether the offenses will be discussed in light of T-Mobile U.K.‘s planned merger with Orange.

• T-Mobile UK Rubber-Stamps Orange Merger As Profits Go On Falling