Forest Global Training Partners

Cyber Risks · Krebs on Security

Crooks Steal Phone, SMS Records for Nearly All AT&T Customers

Summary: AT&T disclosed that intruders accessed an AT&T workspace on a third-party cloud platform in April and downloaded call and text records covering roughly 110 million people, nearly all its customers, for periods between May 1 and October 31, 2022, and on January 2, 2023. The records did not include call or text content, Social Security numbers, or dates of birth, but a subset included cell tower location data, and AT&T said the cloud database was protected only by a username and password with no multi-factor authentication.

Key Takeaway: The stolen data is metadata on who contacted whom, and AT&T itself noted that publicly available tools can often link a phone number to a name, so the exposure reaches beyond the 110 million records to the relationships they map. AT&T also delayed disclosure at the FBI's request and told the SEC the incident is unlikely to materially affect its financial condition, after reporting more than $30 billion in revenue in its most recent quarter.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related