DATA OF NEARLY ALL AT&T CUSTOMERS DOWNLOADED FROM A THIRD-PARTY PLATFORM IN SECURITY BREACH

The data of nearly all customers of the telecommunications giant AT&T was downloaded from a third-party platform in a security breach, the company said last weekend, as cyberattacks against businesses, schools and health systems continue to spread globally.

The breach, which took place in April of this year but mostly involved data from 2022, hit AT&T’s cellular customers and customers of mobile virtual network operators using AT&T’s wireless network, as well as landline customers who interacted with those cellular numbers.

Approximately 109 million customer accounts were impacted, according to AT&T, which said that it currently doesn’t believe that the data is publicly available.

“The data does not contain the content of calls or texts, personal information such as Social Security numbers, dates of birth, or other personally identifiable information,” AT&T said.

The compromised data also doesn’t include some information typically seen in usage details, such as the time stamp of calls or texts, the company said, or customer names. AT&T, however, said that there are often ways of using publicly available online tools to find the name associated with a specific telephone number.

Cybersecurity experts concurred, saying that such data can be used to trace users.

“While the information that was exposed doesn’t directly have sensitive information, it can be used to piece together events and who may be calling who. This could impact people’s private lives as private calls and connections could be exposed,” Thomas Richards, principal consultant at Synopsys Software Integrity Group, said in an emailed statement. “The business phone numbers will be easy to identify and private numbers can be matched to names with public record searches.”