AT&T says it will begin notifying consumers about a data breach where cybercriminals stole phone records of “nearly all” of its cellular and landline customers

Stolen data includes millions of AT&T customer phone numbers, calling and text records, and location-related data.

TechCrunch 2024-07-12 Zack Whittaker

Context & Ripple Effects

This is AT&T’s second major customer-data disclosure in the coverage arc: in March, the company confirmed an online dataset containing personal data for current and former account holders after a breach seller posted a 73 million-customer dataset. The new incident concerns communications records rather than the earlier account-holder data.

The scale and sensitivity of phone numbers, calling and texting records, and location-related data raise the stakes beyond a routine credential reset. It also follows AT&T’s confirmation that older customer data had appeared online, making breach response and customer trust a recurring operational issue for the carrier.

First-order effects

AT&T must notify a customer base spanning nearly all of its cellular and landline subscribers and manage the resulting support, remediation, and trust burden.
Affected customers face elevated risk of targeted phishing or impersonation because communications and location-related records can add context to social-engineering attempts, even where message contents are not reported as stolen.

Second-order effects

The disclosure increases pressure on large carriers to review how communications metadata is retained, accessed, and monitored, since such data can be highly useful when combined with other leaked personal information.
AT&T’s repeated disclosures may make customer-security practices a more visible differentiator in carrier retention and acquisition, while increasing scrutiny of its incident-response processes.

Third-order effects

If large-scale telecom metadata thefts continue, communications records will be treated more explicitly as high-value consumer data, pushing the industry toward tighter access controls, shorter retention where feasible, and more rigorous third-party oversight.
The pattern could also intensify regulatory and legal attention on whether major network operators adequately protect the data generated by essential communications services; the extent will depend on findings about how the records were accessed and secured.

The trend: Telecom operators are facing a broader shift in which metadata from everyday connectivity is recognized as a security-sensitive asset, not merely operational network data.

Discussion

@zackwhittaker@mastodon.social Zack Whittaker on mastodon
AT&T said in its statement that “at least one person has been apprehended” following the data breach. AT&T said the person was not an employee. — Incident response firm Mandiant is tracking the crime crew behind the Snowflake account breaches as UNC5537, a financially motivate…
@josephfcox Joseph Cox on x
FBI confirms in a statement just now that it worked with AT&T to delay announcement of the breach due to national security and/or public safety concerns. During this time, AT&T and FBI investigated, shared intelligence https://www.404media.co/... [image]
@merrux Ali on x
@josephfcox Why was att letting this data out unencrypted? Makes me wonder what else was stoken from snowflake
@josephfcox Joseph Cox on x
It is mind boggling how many breaches are due to hackers breaking to Snowflake accounts. Ticketmaster. Santander. Now AT&T call records. Mandiant found hundreds of Snowflake credentials exposed. It really can be as easy as go to Telegram, use creds https://www.404media.co/... [im…
@jeremybiltz @jeremybiltz on x
Not great, Bob. Not my mobile carrier, but incredibly concerning. Also... SMS is basically open text in the air. Never send important or sensitive info via text. Use a secure app.
@josephfcox Joseph Cox on x
AT&T says it learned of the breach in April. It found hackers had broken into a third-party cloud service used by the telecom giant (AT&T told me it was Snowflake, the center of an ever increasing number of high profile breaches). Here is what AT&T said https://www.404media.co/..…
@bob_hlbok Bob on x
Honestly, at this point, it's a very thin line between data breach and 3rd party business parties.
@bax1337 @bax1337 on x
use signal.
@jofpin Jose Pino on x
As time goes by, I am completely sure that cybersecurity will be the next bubble within the next 36 months. Cyberattacks are becoming increasingly intense. https://x.com/...
@josephfcox Joseph Cox on x
Breaking: hackers stole call and text records for “nearly all” AT&T customers. Shows which phone numbers a customer called or texted. A staggering and unprecedented data breach. Data usually only available to authorities; now hackers got it https://www.404media.co/...
@benlovejoy @benlovejoy on x
Includes details of who called or messaged whom during a six-month period ...
@rustybrick Barry Schwartz on x
Hope no one looks at my call logs and sees how unpopular I really am.....
@carnage4life Dare Obasanjo on x
Every week, there's a revelation of a data breach or ransomware payment made by an institution critical to daily life. Telcos, banks, hospitals, etc. It's depressing to realize that practically every database with our private data is available on the dark web for a price. [image]
@silvermanjacob Jacob Silverman on x
“one of the biggest breaches of private communications data in recent memory” https://www.bloomberg.com/...
r/cybersecurity r on reddit
AT&T says criminals stole phone records of ‘nearly all’ customers in new data breach
r/technology r on reddit
Nearly all AT&T cell customers' call and text records exposed in a massive breach | CNN Business
r/news r on reddit
Nearly all AT&T cell customers' call and text records exposed in a massive breach | CNN Business

Chronicles