Editor’s Note: In a startling development, AT&T has revealed a substantial data breach affecting the call and text records of over 100 million customers, including users of MVNOs like Cricket and Boost Mobile. This incident, spanning from May 2022 to early 2023, highlights critical vulnerabilities in data security practices. With threat actors accessing information via a third-party cloud platform, this breach underscores the urgent need for robust cybersecurity measures in protecting sensitive customer data. Our concise analysis delves into the breach’s implications, AT&T’s response, and the broader ramifications for cybersecurity, information governance, and eDiscovery professionals.
Content Assessment: AT&T Faces Major Cybersecurity Breach Affecting Over 100 Million Customers
Information - 93%
Insight - 92%
Relevance - 91%
Objectivity - 90%
Authority - 92%
92%
Excellent
A short percentage-based assessment of the qualitative benefit expressed as a percentage of positive reception of the recent article from ComplexDiscovery OÜ titled, "AT&T Faces Major Cybersecurity Breach Affecting Over 100 Million Customers."
Industry News – Cybersecurity Beat
AT&T Faces Major Cybersecurity Breach Affecting Over 100 Million Customers
ComplexDiscovery Staff
In a significant cybersecurity incident, AT&T, the Dallas-based telecommunications giant, has disclosed a data breach impacting the call and text records of more than 100 million of its customers. This breach also includes customers of mobile virtual network operators (MVNOs) such as Cricket, Boost Mobile, and Consumer Cellular. The incidents occurred between May 1, 2022, and October 31, 2022, with an additional breach on January 2, 2023, raising serious concerns about data security.
AT&T spokesperson Alex Byers confirmed to The Verge that the threat actors accessed customer data through the company’s account on a third-party cloud platform, Snowflake. This method of access is similar to previous breaches that impacted organizations like Ticketmaster and Santander Bank. Byers clarified that the breach included phone numbers, counts of calls and texts, and total call durations for specific days or months. However, the content of calls or texts, timestamps, and personally identifiable information such as Social Security numbers or dates of birth were not compromised.
The company first learned of the breach in April but delayed public disclosure twice after the FBI and the Department of Justice cited potential risks to national security and public safety. Byers emphasized that AT&T does not believe the data is publicly available and that steps have been taken to close off the illegal access point. “We will provide notice to current and former customers whose information was involved along with resources to help protect their information,” the company stated in a blog post.
In an email statement to TIME, Byers added, “We sincerely regret this incident occurred and remain committed to protecting the information in our care.”
This breach has garnered significant attention, particularly as AT&T experienced a similar incident earlier in the year affecting over 70 million customers. The impact of the latest breach is extensive, involving nearly all AT&T cellular customers, those using MVNOs that operate on AT&T’s network, and several AT&T landline customers.
According to AT&T’s SEC filing, hackers unlawfully accessed the company’s workspace on Snowflake between April 14 and April 25, 2024, exfiltrating files containing records of customer interactions. The breach included telephone numbers, counts of interactions, aggregate call durations, and, in some cases, cell site identification numbers.
AT&T has collaborated with external cybersecurity experts to investigate the extent of the breach. The company assured customers that the breached data does not include any other sensitive information. However, AT&T acknowledged that while customer names were not part of the stolen data, there are often methods to identify names associated with specific phone numbers using public online tools.
To mitigate the breach, AT&T has notified affected customers and provided advice on protecting themselves from potential phishing and scamming attempts. The company recommends only opening text messages from known contacts, avoiding sharing personal details in replies to unknown senders, and verifying website security by looking for “https” in website URLs.
The telecommunications giant has taken measures to secure the affected third-party cloud-based workspace and has been working with law enforcement to apprehend those involved in the breach. The company confirmed that at least one individual has been apprehended in connection with the incident.
Despite the data breach, AT&T maintains that this incident has not materially impacted its operations or financial condition. As a precaution, AT&T has set up a dedicated web page to provide information and updates on the breach. The company also offers support through its customer service channels, where customers can inquire if their data was part of the breach.
The repeated data breaches underscore the growing concerns over digital privacy and cybersecurity. As data security becomes increasingly critical in the digital age, companies must continuously enhance their protective measures to safeguard customer information.
News Sources
- AT&T breach involving 2022 customer data caused by third-party ‘threat actor’
- AT&T Admits Its Network Was Breached by Massive Hack Impacting ‘Nearly All’ Customers
- AT&T announces massive hack of ‘nearly all’ cellular customers
- AT&T Customers Impacted By Data Breach Should Do This Now
- AT&T breach leaked call and text records from ‘nearly all’ wireless customers
Assisted by GAI and LLM Technologies
Additional Reading
- Prudential Financial’s Data Breach Impact Soars to Over 2.5 Million Customers
- Evolve Bank Cyberattack Exposes Sensitive Data, Impacts Fintech Partners Wise and Affirm
Source: ComplexDiscovery OÜ