Originally, Experian was picking up the tab but T-Mobile has hired someone else. Now I've got a feeling there's going to be some lawyers involved to get Experian to pay for it.
As for the DP... they would go after Experian. INAL, but there might be something said against T-Mobile (again.. cue the lawyers) as case could be made that T-Mobile didn't do 100% due diligence in selecting a credit agency to process.
Might need a bigger bag of popcorn if the lawyers really get involved. If they do, perhaps other companies might take a look and realize that security can't be blown off.