Massive AT&T Data Breach Exposes Nearly All Wireless Customer Data
In a monumental breach, AT&T has revealed that a recent cyberattack has exposed the records of almost all its wireless customers. The breach, which occurred between April 14 and April 25, 2024, resulted in the unauthorized access and exfiltration of customer call and text interaction records dating back to May 1 through October 31, 2022, and January 2, 2023.
In an SEC filing, AT&T clarified that the compromised data does not include the content of calls or texts, nor does it contain personal information such as Social Security numbers or dates of birth. However, the breach has affected a wide range of data, including telephone numbers and records of call durations. For a subset of records, cell site identification numbers were also exposed.
AT&T noted the potential privacy implications, stating that while the stolen data lacks direct personal identifiers, it can be cross-referenced with publicly available tools to identify specific individuals. Experts warn that this data can be used to piece together call patterns and identify private interactions. Thomas Richards of Synopsys Software Integrity Group highlighted the risk of private and business communications being exposed, while Tony Anscombe of ESET emphasized the potential for targeted attacks using combined data from other breaches.
Customers are advised to be vigilant against spearphishing and identity theft attempts. Anscombe recommends verifying any unexpected messages from known contacts through a different communication method to ensure their legitimacy.
Despite the breach, AT&T reported to the SEC that the incident has not materially impacted its operations or financial condition. The company has around 115 million wireless customers.
The breach has been linked to a series of attacks on the Snowflake cloud platform. According to Mandiant, the attacker group UNC5537 exploited stolen credentials from infostealer malware to compromise multiple Snowflake instances. AT&T confirmed that the stolen data was illegally downloaded from a workspace on a third-party cloud platform, and while the data is not believed to be publicly available, at least one suspect has been apprehended.
Other high-profile victims of the Snowflake attack campaign include Ticketmaster, Santander Bank, and State Farm. AT&T continues to investigate the breach and enhance its security measures to prevent future incidents.
