AT&T has finally admitted that a data leak affected 73 million current and former customers. Initially, the company denied any connection to the leaked data, despite multiple claims over the past two weeks. However, AT&T’s stance changed upon the disclosure of the hack.
The telecom company said in a statement over the Easter weekend that the data set appears to be from 2019 or earlier. Approximately 65.4 million former AT&T customers, as well as 7.6 million current account holders, are impacted by it.
The data set includes passcodes, dates of birth, Social Security numbers, phone numbers, email addresses, mailing addresses, and AT&T account numbers. The company raised doubt over whether the data came from AT&T systems or a vendor.
The threat actor Shiny Hunters purportedly claimed the sale of stolen data belonging to 73 million AT&T customers in 2021. Despite their claims, AT&T denied any compromise or link to the data. However, in 2024, another threat actor uploaded the dataset on a hacking forum, claiming it contained the same information as Shiny Hunters’.
AT&T discovered activity on BreachForums, a renowned underground marketplace popular with hackers. This marketplace is well-known for trading malware, hacked accounts, stolen data, and other illegal products.
MajorNelson, a BreachForums user, has claimed responsibility for AT&T’s recent data leak. The message, captioned ‘AT&T Division Database Hacked by @ShinyHunters (2021),’ emphasises the severity of the issue.
Security experts discovered the infamous hacker group ShinyHunters for the first time in 2020. The gang gained recognition for their roles in many well-publicized data breaches.
Notably, they were responsible for a breach at T-Mobile, which compromised the data of 40 million customers. This breach took place just weeks before the AT&T breach.
AT&T is already alerting its 7.6 million current account users of the compromise and has swiftly changed their passcodes for them. There are also alerts going out to past clients whose “sensitive personal information” was compromised. Passcodes, unlike passwords, often use a numeric sequence for user authentication.
AT&T Faces Multiple Class-Action Lawsuits
AT&T now faces additional challenges in the form of numerous class-action lawsuits following the company’s disclosure of the data leak. Morgan & Morgan is handling one of the 10 claims filed since Saturday, representing plaintiff Patricia Dean and others in similar circumstances.
This added information highlights the seriousness of the security compromise and the possible legal consequences for AT&T.
Dean’s complaint focuses attention on how AT&T’s insufficient security protocols and delayed notifications put customers at risk of identity theft. The complaint requests a jury trial, enhanced security measures, and compensatory damages.
The lawsuit alleges that AT&T breached contracts, engaged in unjust enrichment, and was negligent. It seeks a jury trial, company-funded credit monitoring services, improved data security procedures, restitution, compensatory damages, and injunctive relief.
Users need to make use of the three main US credit agencies’ complimentary fraud alert services. Users have to additionally make use of the three main US credit agencies’ complimentary fraud alert service. AT&T further declared that individuals impacted will be eligible for complimentary credit monitoring. Customers can visit the AT&T website to get more information.
Help your colleagues keep a security-first mindset and boost your human firewall by starting your Phishing Tackle security awareness training today with our two-week free trial.
