They never said they only keep the credit information for 25 months, just that the minimal they have to keep it is 25 months.
Which is where they got the Sept 2013 - Sept 2015 affected dates from; anything longer than that, Experian's keeping it because of themselves and not because of regulatory laws. Tmobile's official Twitter announcements, account alerts, and statement releases have all said Sept 2013-2015. They, or more likely Experian, lied.
The csid signup is at csid.com/tmobile, if anyone else don't want to trust Experian's protectmyid service.