AT&T Corp. disshutd today that a recent data baccomplish has exposed phone call and text message write downs for cimpolitely 110 million people — cforfeitly all of its customers. AT&T shelp it postponecessitate disclosing the incident in response to “national security and accessible getedty worrys,” noting that some of the write downs comprised data that could be engaged to remend where a call was made or text message sent. AT&T also acunderstandledged the customer write downs were exposed in a cboisterous database that was geted only by a engagername and password (no multi-factor authentication necessitateed).
In a regulatory filing with the U.S. Securities and Exalter Corelocaterlookion today, AT&T shelp cyber intimpoliters accessed an AT&T toilspace on a third-party cboisterous platestablish in April, downloading files retaining customer call and text includeions between May 1 and October 31, 2022, as well as on January 2, 2023.
The company shelp the stolen data comprises write downs of calls and texts for mobile providers that resell AT&T’s service, but that it does not comprise the satisfyed of calls or texts, Social Security numbers, dates of birth, or any other personassociate identifiable proposeation.
However, the company shelp a subset of stolen write downs comprised proposeation about the location of cellular communications towers shutst to the subscriber, data that could be engaged to remend the approximate location of the customer device initiating or receiving those text messages or phone calls.
“While the data does not comprise customer names, there are frequently ways, using accessiblely useable online tools, to discover the name associated with a definite telephone number,” AT&T apchecked.
AT&T’s shelp it lgeted of the baccomplish on April 19, but postponecessitate disclosing it at the ask of federal allotigators. The company’s SEC discloconfident says at least one individual has been arrested by the authorities in joinion with the baccomplish.
In a written statement allotd with KrebsOnSecurity, the FBI checked that it asked AT&T to postpone alerting impacted customers.
“Shortly after remending a potential baccomplish to customer data and before making its materiality decision, AT&T reach outed the FBI to tell the incident,” the FBI statement reads. “In appraiseing the nature of the baccomplish, all parties talked a potential postpone to accessible telling under Item 1.05(c) of the SEC Rule, due to potential dangers to national security and/or accessible getedty. AT&T, FBI, and DOJ toiled collaboratively thcimpolite the first and second postpone process, all while sharing key menace intelligence to bolster FBI allotigative equities and to help AT&T’s incident response toil.”
Techcrunch quoted an AT&T spokesperson saying the customer data was stolen as a result of a still-unfgreatering data baccomplish involving more than 160 customers of the cboisterous data provider Snowflake.
Earlier this year, malicious hackers figured out that many beginant companies have uploaded massive amounts of priceless and comfervent customer data to Snowflake servers, all the while geting those Snowflake accounts with little more than a engagername and password.
Wired telled last month how the hackers behind the Snowflake data thefts buyd stolen Snowflake credentials from unreasonable web services that sell access to engagernames, passwords and authentication tokens that are siphoned by proposeation-stealing harmful programs. For its part, Snowflake says it now needs all recent customers to engage multi-factor authentication.
Other companies with millions of customer write downs stolen from Snowflake servers comprise Advance Auto Parts, Allstate, Anheengager-Busch, Los Angeles Unified, Mitsubishi, Neiman Marcus, Pure Storage, Santander Bank, State Farm, and Ticketmaster.
Earlier this year, AT&T reset passwords for millions of customers after the company finassociate acunderstandledged a data baccomplish from 2018 involving approximately 7.6 million current AT&T account hgreaterers and cimpolitely 65.4 million establisher account hgreaterers.
Mark Burnett is an application security architect, adviseant and author. Burnett shelp the only authentic engage for the data stolen in the most recent AT&T baccomplish is to understand who is reach outing whom and how many times.
“The most worrying skinnyg to me about this AT&T baccomplish of ALL customer call and text write downs is that this isn’t one of their main databases; it is metadata on who is reach outing who,” Burnett wrote on Mastodon. “Which creates me wonder what would call logs without timestamps or names have been engaged for.”
It remains unevident why so many beginant corporations persist in the belief that it is somehow adchooseable to store so much comfervent customer data with so confineed security getions. For example, Advance Auto Parts shelp the data exposed comprised filled names, Social Security numbers, drivers licenses and rulement publishd ID numbers on 2.3 million people who were establisher engageees or job applicants.
That may be becaengage, apart from the class-action litigations that invariably ensue after these baccomplishes, there is little hgreatering companies accountable for sloppy security trains. AT&T tgreater the SEC it does not consent this incident is probable to materiassociate impact AT&T’s financial condition or results of operations. AT&T telled revenues of more than $30 billion in its most recent quarter.
