Massive Data Breach Exposes Call and Text Records of AT&T Customers

AT&T Corp. has revealed a significant data breach that has compromised the phone call and text message logs of approximately 110 million individuals, representing the majority of its customer base. The telecommunications giant delayed the announcement of the breach citing concerns related to national security and public safety. The exposed records were stored in a cloud database protected solely by a username and password.

According to the disclosure made to the U.S. Securities and Exchange Commission, cyber intruders infiltrated an AT&T workspace on a third-party cloud platform, gaining access to files containing customer call and text interactions over specific periods in 2022 and 2023. The stolen data encompassed details of calls and texts for mobile providers reselling AT&T services, with some records containing information on the location of cellular communication towers in proximity to the subscriber.

The FBI and the Department of Justice collaborated with AT&T upon the discovery of the breach, with federal investigators requesting a delay in customer notification to address potential threats to national security and public safety. More than 160 customers of the cloud provider Snowflake were implicated in the data breach, as per reports from KrebsOnSecurity.

Malicious actors obtained stolen Snowflake credentials from the dark web, using them to access sensitive data from various companies, including AT&T. Advanced Auto Parts, Allstate, Anheuser-Busch, Mitsubishi, and others were also affected by data breaches involving Snowflake servers.

Mark Burnett, an application security architect, expressed concerns over the breach stating that the stolen call and text logs could potentially reveal connections between individuals. The incident raises questions about the security practices of major corporations and their storage of sensitive customer data.

Despite the recurring data breaches, companies often avoid severe repercussions beyond class-action lawsuits. AT&T reported that it does not expect significant financial repercussions from the latest breach, further highlighting the need for stronger data protection measures in the corporate sector.