A massive cyberattack against AT&T exposed data from “nearly all” of its customers and downloaded it to a third-party cloud platform, AT&T said in a press release.
“We have taken steps to close off the illegal access point,” AT&T said in the statement. The company said it was working with law enforcement to arrest those involved, and that at least one person had been apprehended.
The compromised data included files containing AT&T records of calls and texts from cellular customers, wireless network customers and landline customers between May 2022 and October 2022, and records from January 2, 2023, for a small number of customers. The records identify the telephone numbers an AT&T cellular number interacted with during those periods, but does not contain the content of calls or texts or information such as SSNs or other personally identifiable information (PII).
AT&T said customer data was “illegally downloaded from our workspace on a third-party cloud platform.” While the company did not specifically name the platform, some folks are questioning whether the incident is linked to a recent series of data heists from the Snowflake platform, where attackers compromised hundreds of Snowflake instances. AT&T spokesperson Andrea Huguely told TechCrunch that the most recent compromise of customer records were stolen from the cloud data giant Snowflake during a recent spate of data thefts targeting Snowflake’s customers.
Here are what a few industry experts are saying about this latest AT&T data breach news:
Kern Smith, Vice President, Americas, at Zimperium:
Mobile devices are one of the primary targets for attackers to compromise credentials, through either phishing, malware, network, or device exploits attacks, and are often overlooked by companies as part of their overall security strategy. It is important that organizations ensure that both they, and their vendors have appropriate security tooling in place to prevent credential compromises which can be leveraged downstream for larger attacks and breaches. As part of a comprehensive security strategy, organizations must ensure that both they, and their vendor’s mobile devices are protected from these attacks.
++
Jason Soroko, Senior Vice President of Product at Sectigo, a Scottsdale, Arizona-based provider of comprehensive certificate lifecycle management (CLM):
Companies using Snowflake should immediately implement multi-factor authentication (MFA) to enhance security and protect sensitive data. MFA provides an additional layer of defense against unauthorized access, significantly reducing the risk of breaches. This is true, not just for Snowflake, but anyone using a third party service via an authenticated session, that authentication needs to be using a credential stronger than just username and password.
++
Darren Guccione, CEO and Co-Founder at Keeper Security, a Chicago-based provider of zero-trust and zero-knowledge cybersecurity software:
AT&T’s latest announcement revealing another major data breach is a painful, second blow to the millions of customers who have already lost trust after having their private information exposed by the company earlier this year. Although the leaked phone records do not contain the contents of calls and text messages, they do provide records of who customers interacted with, and some include identification numbers that could help bad actors determine where calls were made and texts were sent.
The disclosure of this information – following the leak of Social Security numbers, names, email and mailing addresses, phone numbers, dates of birth, account numbers and passcodes – is a clear violation of personal privacy and trust. These massive breaches, affecting millions of customers, underscore the persistent and evolving threats to digital security, and why everyone must take concrete, proactive steps to safeguard their own sensitive information.
Although the information in AT&T’s latest breach is less sensitive than the personal details leaked in the prior breach, customers affected by either of these breaches should take the following steps to protect their identity:
- Change the password and passcode for your AT&T account immediately. A password manager can generate strong and unique passwords for every account.
- Enable Multi-Factor Authentication (MFA) to add an extra layer of security that makes it more difficult for cybercriminals to access your accounts.
- Monitor your accounts for suspicious activity including strange transactions, unrecognized login attempts and sign-ins from unknown devices.
- Sign up for a dark web monitoring service like BreachWatch® so you can be notified immediately if your information has been compromised.
- Freeze your credit to prevent lenders from approving new loans or credit lines in your name. You can unfreeze it at any time.
This breach is also a wakeup call for organizations to reevaluate their cybersecurity strategies, emphasizing proactive measures over reactive responses. As cyber threats evolve, organizations must prioritize protecting customer data. Today, identity applications require both authentication and end-to-end encryption to provide robust cybersecurity protection. Cybersecurity technologies protecting these environments must cover every user, on every device, from every location.
Data shows the human element is far more difficult to protect, and often, the most error-prone element of the attack chain, therefore, organizations should focus on implementing zero-trust security architecture and a policy of least-access to prevent unauthorized privilege escalation and ensure strict enforcement of user access roles. A Privileged Access Management (PAM) platform is essential for managing and securing privileged credentials, ensuring least privilege access and preventing lateral movement in the event of a breach.
Robust threat intelligence, continuous monitoring and rapid incident response are also critical. Companies should have security event monitoring to detect and analyze privilege escalations, enabling the detection and blocking of anomalous behavior.
++
Narayana Pappu, CEO at Zendata:
The data was reportedly downloaded from a third-party cloud platform. This highlights the risks associated with entrusting sensitive data to external partners or services and the importance of understanding the PII supply chain risk (what data you collect and store, who you share it with, for how long, and more importantly, is that data still needed, if not archived/deleted).
++
Pranava Adduri: former founding engineer at Rubrik and current CEO and co-founder of Bedrock Security
The AT&T breach demonstrates that adversaries don’t follow any set rules. Organizations need to understand that adversaries don’t have a playbook or a reliable indicator of attack (IOA) that security teams can use to predict threats.
What this incident highlights is the necessity for organizations to comprehend how their entire ecosystem—partners, vendors, employees, and the entire IT stack (which in this case included Snowflake)—is accessing and using their data. Having a data bill of materials (DBOM) is fundamental to understanding risk exposure, whether internal or from other vendors or users.
++
Roei Sherman: Field CTO at Mitiga
The AT&T data breach underscores the growing risks associated with the vast amounts of data companies now store on cloud and SaaS platforms. As organizations increasingly rely on these technologies, the complexity of detecting and investigating breaches has risen sharply. This incident highlights that the speed at which a breach is detected and investigated is directly tied to the blast radius and overall outcome of the incident.
As witnessed in the Snowflake campaign, sometimes you can’t enforce specific security configurations on your SaaS, which makes detection and investigations critical. Timely detection and swift response are critical to minimizing the damage and protecting customer data. As we’ve seen with this breach, delays in these processes can lead to significant repercussions. It is essential for organizations to prioritize advanced threat detection and rapid incident response strategies to mitigate the impact of such breaches.
++
Jake Williams: former NSA hacker, Faculty at IANS Research
The threat actors have used data from previous compromises to map phone numbers to identities. What the threat actors stole here are effectively call data records (CDR), which are a gold mine in intelligence analysis because they can be used to understand who is talking to who—and when.
It’s unclear what breach notification requirements this triggers for businesses using AT&T to communicate with customers. It will be interesting to see if AT&T processes breach notifications on behalf of impacted customers, as Change Healthcare did. However, this situation is more complicated: identifying victims outside of AT&T’s customers (numbers dialed) is more complicated, and it’s not clear which call/SMS records (if any) come with a notification burden.
I personally have a hard time with all the blame Snowflake is getting. They had to balance customer adoption with ease of use and didn’t force users to employ stronger security settings. But those more secure configuration options were available. This is akin to a car in the 80s that had seat belts but no alarm for unbuckling. If the manufacturer provided a safety option you chose not to use and you get hurt, whose fault is it?
When discussing this AT&T breach, this is what you need to know:
- Even if you aren’t an AT&T customer, you may still have some exposure if you work with an MVNO (mobile virtual network operator) that piggybacks on AT&T’s network.
- Threat actors might use this data (if publicly exposed) to connect your organization to other organizations. This may create new risks if you were trying to keep those associations out of the public view.
- Threat actors might use this data to understand who is using SMS-based MFA. In some cases, they might use this to determine which services are in use. To the extent we are still relying on SMS-based MFA, we should consider migrating those apps ASAP.
- We may have our own breach notification requirements coming from this breach of AT&T’s data.
- This compromise demonstrates yet again how threat actors may combine data from previous incidents to exacerbate impacts. Previous AT&T incidents mapped customer phone numbers to other identifying information, simplifying the weaponization of the newly compromised data.
Shawn Waldman: CEO and Founder of Secure Cyber Defense
This breach underscores the importance of securing third-party services. Companies should implement multi-factor authentication and conduct regular security audits of their entire ecosystem, including partners, vendors, and IT infrastructure. Monitoring data usage for anomalies can help detect breaches early. The potential exposure of cell tower data is particularly alarming, as it could allow threat actors to pinpoint locations based on phone numbers, raising significant physical security concerns. Organizations should ensure robust security measures are in place and consider default practices like locking down credit and monitoring credit reports. While breaches involving personal information are not new, the ability to correlate data to specific locations introduces a new level of risk that must be addressed.
++
Scott Kannry: Co-founder and CEO of Axio
The AT&T data breach highlights the critical importance of securing personally identifiable information (PII). Names, addresses, phone numbers, dates of birth, and social security numbers are the most valuable data to cybercriminals, especially your DOB and social security number—those never change, making identity a primary attack vector targeted not only for the initial breach but also for lateral movement within networks.
These attacks remind us that getting hacked is no longer a question of if, but when. Companies must focus on building cyber security programs that prioritize resilience and have robust recovery processes in place. Additionally, given the dynamic nature of operating conditions, a robust cybersecurity framework that includes comprehensive risk assessments and continuous monitoring is essential.
Many organizations approach cyber risk management as a discrete activity. In reality, cyber risk management is a continuous process. Investment in a continuous cyber risk management process is valuable for the potential to proactively characterize cyber risk impact on the bottom line. This requires consideration of cyber risk quantification in every step of the continuous cyber risk management lifecycle, improving an organization’s ability to not only understand the financial impact of gaps in their cyber security program, but also prioritize investments to protect their data, ensure regulatory compliance, and safeguard their reputation.
++
Nick Tausek, Lead Security Automation Architect at Swimlane
Today, AT&T has confirmed the breach involving six months of data containing call and text message records of “nearly all” of its customers. AT&T is sending notifications to around 110 million customers.
The company believes that threat actors gained access through Snowflake, a third-party cloud platform whose customers have been actively targeted with data theft since April this year. The exfiltrated information includes calling and texting records, the total count of calls and texts, and call durations. Although AT&T stated the breach did not reveal customer names, they did point out that it is feasible to link phone numbers with their associated names through public online tools.
This breach carries significant implications for data security. This is not the first breach AT&T has disclosed this year. Telecommunication companies, with their vast troves of sensitive data and customer information, must view this incident as a stark reminder that proactive cybersecurity measures are essential. Relying solely on reactive tools is insufficient. A layered security strategy including incident detection, response, and prioritizing visibility across the entire IT infrastructure is crucial for securing the SOC.
++
John Gunn, CEO, Token
This is what economists call a negative externality, the imposing of costs on a party, in this case ATT customers, as a direct effect of the actions of another party, in this case inadequate cybersecurity. The sudden rise in class action lawsuits where large groups of customers sue for huge sums of damages will likely soon be the remedy for this.
++
Clyde Williamson, Product Manager, Protegrity
Data breach incidents at this scale are no longer an anomaly—they’re the new normal. While in this specific example, no confirmed sensitive information was stolen or leaked publicly from AT&T customers, that doesn’t mitigate the sheer number of customers impacted. Records of calls and texts from nearly all of their wireless customers being exfiltrated is not only a violation of trust on the customer’s end, but it showcases how thoroughly out of date current cybersecurity strategies are right now.
These customer records are now in the hands of threat actors, who can glean whatever inferences they can from the numbers called, how long they were called, the number of times they were called, etc. While some may think sensitive information like Social Security numbers, emails, names, and other personal identifiable information (PII) are the only types of data that have an impact on customers, the inferences that can be made from different types of data matter just as much.
Stolen data has a long tail of impact, not just on the companies, but also on the trust customers place in them. Data breaches of increasing impact and size are happening more often, making it critical that organizations rethink their approach to data security and protection. Rather than protecting around the data with traditional security measures, they need to adopt data de-identification methods to protect the actual data while retaining its value internally and rendering it useless to attackers even when stolen.
++
Dr. Katie Paxton-Fear, Security Researcher, Traceable AI
This attack and other Snowflake breaches we’ve seen in the past few weeks really demonstrate how much damage third-party breaches can do. When you put your trust and your customer’s trust into a third party, you are implicitly linking their brand to your own. It is very important to vet the security of your vendors and to ensure before you onboard any new vendors, they have appropriate incident response plans and will alert you of data breaches. This is particularly true for integrations like this example, where your third-party tool is automatically getting data from your systems and highlights how important monitoring network and API traffic is.
##
