AT&T, one of the largest telecommunications companies in the United States, has revealed a significant data breach that occurred between May and October 2022. The incident exposed call and text message records of tens of millions of the company’s cellular customers, as well as non-AT&T customers who interacted with AT&T numbers.
The compromised data includes telephone numbers of nearly all their cellular customers and those using its network during the specified period. Records of calls and texts made by customers, including the number of interactions and call durations, were also exposed. However, the company stated that the content of communications and precise timestamps were not part of the breach.
AT&T discovered the breach in April 2023 when a threat actor claimed to have unlawfully accessed and copied AT&T call logs. The company immediately initiated an investigation, revealing that files were exfiltrated between April 14 and April 25, 2023.
At the time, the U.S. Department of Justice had requested a delay in public disclosure, citing potential national security and public safety concerns. This marks the first known instance of such a delay request for an SEC disclosure due to these factors.
Cybersecurity experts have expressed concern about the potential misuse of this data. The exposed information could be valuable to cybercriminals and nation-states, potentially enabling the mapping of connections between individuals and the identification of sensitive locations.
AT&T has stated that the breach occurred due to an “illegal download” from a third-party cloud platform. The company is currently working with law enforcement and they have promised to notify affected current and former customers, as well as provide resources that can help protect their information.
The Federal Communications Commission (FCC) has also launched its own investigation into the breach and will be coordinating with their law enforcement partners.
This incident is unrelated to a previous AT&T data leak disclosed in March 2023, which involved the personal information of 73 million current and former customers.
In a statement, AT&T mentioned that they’re “committed to protecting the information” of their customers and that they “sincerely regret this incident occurred.” The company’s stock price experienced a slight decline following the announcement of the breach.