Crooks Steal Phone, SMS Records for Nearly All AT&T Customers – Krebs on Security

AT&T Corp. disclosed at the moment {that a} new knowledge breach has uncovered telephone name and textual content message information for roughly 110 million individuals — practically all of its prospects. AT&T stated it delayed disclosing the incident in response to “nationwide safety and public security considerations,” noting that a number of the information included knowledge that might be used to find out the place a name was made or textual content message despatched. AT&T additionally acknowledged the shopper information had been uncovered in a cloud database that was protected solely by a username and password (no multi-factor authentication wanted).

In a regulatory submitting with the U.S. Securities and Alternate Fee at the moment, AT&T stated cyber intruders accessed an AT&T workspace on a third-party cloud platform in April, downloading information containing buyer name and textual content interactions between Could 1 and October 31, 2022, in addition to on January 2, 2023.

The corporate stated the stolen knowledge contains information of calls and texts for cellular suppliers that resell AT&T’s service, however that it doesn’t embody the content material of calls or texts, Social Safety numbers, dates of beginning, or another personally identifiable info.

Nevertheless, the corporate stated a subset of stolen information included details about the situation of mobile communications towers closest to the subscriber, knowledge that might be used to find out the approximate location of the shopper machine initiating or receiving these textual content messages or telephone calls.

“Whereas the info doesn’t embody buyer names, there are sometimes methods, utilizing publicly out there on-line instruments, to seek out the identify related to a selected phone quantity,” AT&T allowed.

AT&T’s stated it discovered of the breach on April 19, however delayed disclosing it on the request of federal investigators. The corporate’s SEC disclosure says at the very least one particular person has been detained by the authorities in reference to the breach.

In a written assertion shared with KrebsOnSecurity, the FBI confirmed that it requested AT&T to delay notifying affected prospects.

“Shortly after figuring out a possible breach to buyer knowledge and earlier than making its materiality resolution, AT&T contacted the FBI to report the incident,” the FBI assertion reads. “In assessing the character of the breach, all events mentioned a possible delay to public reporting beneath Merchandise 1.05(c) of the SEC Rule, because of potential dangers to nationwide safety and/or public security. AT&T, FBI, and DOJ labored collaboratively via the primary and second delay course of, all whereas sharing key risk intelligence to bolster FBI investigative equities and to help AT&T’s incident response work.”

Techcrunch quoted an AT&T spokesperson saying the shopper knowledge was stolen on account of a still-unfolding knowledge breach involving greater than 160 prospects of the cloud knowledge supplier Snowflake.

Earlier this yr, malicious hackers found out that many main corporations have uploaded huge quantities of helpful and delicate buyer knowledge to Snowflake servers, all of the whereas defending these Snowflake accounts with little greater than a username and password.

Wired reported final month how the hackers behind the Snowflake knowledge thefts bought stolen Snowflake credentials from darkish net companies that promote entry to usernames, passwords and authentication tokens which can be siphoned by information-stealing malware. For its half, Snowflake says it now requires all new prospects to make use of multi-factor authentication.

Different corporations with tens of millions of buyer information stolen from Snowflake servers embody Advance Auto Elements, Allstate, Anheuser-Busch, Los Angeles Unified, Mitsubishi, Neiman Marcus, Progressive, Pure Storage, Santander Financial institution, State Farm, and Ticketmaster.

Earlier this yr, AT&T reset passwords for tens of millions of consumers after the corporate lastly acknowledged a knowledge breach from 2018 involving roughly 7.6 million present AT&T account holders and roughly 65.4 million former account holders.

Mark Burnett is an utility safety architect, guide and creator. Burnett stated the one actual use for the info stolen in the newest AT&T breach is to know who’s contacting whom and what number of occasions.

“Essentially the most regarding factor to me about this AT&T breach of ALL buyer name and textual content information is that this isn’t considered one of their most important databases; it’s metadata on who’s contacting who,” Burnett wrote on Mastodon. “Which makes me surprise what would name logs with out timestamps or names have been used for.”

It stays unclear why so many main firms persist within the perception that it’s one way or the other acceptable to retailer a lot delicate buyer knowledge with so few safety protections. For instance, Advance Auto Elements stated the info uncovered included full names, Social Safety numbers, drivers licenses and authorities issued ID numbers on 2.3 million individuals who had been former workers or job candidates.

That could be as a result of, other than the class-action lawsuits that invariably ensue after these breaches, there’s little holding corporations accountable for sloppy safety practices. AT&T instructed the SEC it doesn’t consider this incident is more likely to materially affect AT&T’s monetary situation or outcomes of operations. AT&T reported revenues of greater than $30 billion in its most up-to-date quarter.