BREAKING: U.S. phone giant AT&T confirmed Friday it will notify millions of consumers about a fresh data breach that allowed cybercriminals to steal the phone and text records of "nearly all" of its customers, a company spokesperson told TechCrunch.

AT&T confirmed the breach was linked to a data theft at cloud data giant Snowflake. AT&T said the data breach affects at least 110 million AT&T customers.

More: https://techcrunch.com/2024/07/12/att-phone-records-stolen-data-breach/

AT&T says criminals stole phone records of 'nearly all' customers in new data breach | TechCrunch

The stolen data includes 110 million AT&T customer phone numbers, calling and text records, and some location-related data.

TechCrunch

AT&T said in its statement that “at least one person has been apprehended” following the data breach. AT&T said the person was not an employee.

Incident response firm Mandiant is tracking the crime crew behind the Snowflake account breaches as UNC5537, a financially motivated threat group with members in North America and at least one member in Turkey.

FBI has not commented on the arrest — yet.

More: https://techcrunch.com/2024/07/12/att-phone-records-stolen-data-breach/

AT&T says criminals stole phone records of 'nearly all' customers in new data breach | TechCrunch

The stolen data includes 110 million AT&T customer phone numbers, calling and text records, and some location-related data.

TechCrunch
@zackwhittaker "at least one person has been apprehended" 10 bucks say that it's not the CEO of either company

@zackwhittaker

"AT&T said the stolen data “does not contain the content of calls or texts,” but does include calling and texting records that an AT&T phone number interacted with during the six-month period, as well as the total count of a customer’s calls and texts, and call durations — information that is often referred to as metadata. The stolen data does not include the time or date of calls or texts, AT&T said"

@FreakyFwoof @zackwhittaker Ouch. That sucks for so many of their customers.
@zackwhittaker Why do phone records exist anymore? They're not customer facing with any carrier I've used in the past decade because they're no longer relevant to billing. Having them at all is a liability.
@zackwhittaker totally cool for all of the other providers' customers right? Except for their communications with those att customers, right?
@zackwhittaker daily reminder that SMS should be abandoned.
@zackwhittaker NSA level access to data, for the highest bidder...

@zackwhittaker

Man, John's gonna be pissed...

@zackwhittaker So, the thieves got basically the phone bills for all AT&T customers, plus source/destination of customer SMS communications. Why is there also cell site info in some of these records? Is there any indication the intruders compromised a law enforcement portal or account?
@briankrebs
I've seen this claim that it was using stolen Snowflake account credentials. https://www.helpnetsecurity.com/2024/07/12/att-stolen-records/
You'll already have seen that "Based on information available to us, we understand that at least one person has been apprehended.": https://www.att.com/support/article/my-account/000102979
@zackwhittaker
Hackers stole call, text records of "nearly all" of AT&T's cellular customers - Help Net Security

Hackers have stolen records of calls and texts made by “nearly all" cellular customers of AT&T from May to October 2022.

Help Net Security
@briankrebs What surprises me is this: "It doesn’t have the time stamps for the calls or texts"
IDK, but it suggests to me that it wasn't the call/text records, which, I could be wrong, but I'd expect to have timestamps, which maybe means it was some aggregated analysis of call/text records? IDK.
@zackwhittaker

@zackwhittaker

And you get to find out about it, as a customer, 2 years later.

@zackwhittaker when will enough be enough for them.. 🤔🤨
@stux @zackwhittaker dunno, there is so much more data to fetch?

@stux @zackwhittaker

Never. One good solution is for non-USA businesses and individuals to just stop using US-based services.

Our regulations now are just decorative due to the recent Supreme Court ruling and all that is left, is for the right cases to file up so businesses can do whatever they want.

@zackwhittaker @Sarahp “Snowflake allows its corporate customers, like tech companies and telcos, to analyze huge amounts of customer data in the cloud. It’s not clear for what reason AT&T was storing customer data in Snowflake, and the spokesperson would not say.”

I’m not seeing much difference between corporate customers, tech companies and telcos having access to this data vs. actual criminals. (1/2)

I have little doubt that Snowflake would sell access to *anyone* for the right amount of money. That would include criminals. And nowadays, I don’t see a lot of difference between “corporate customers” and criminals. (2/2)

@zackwhittaker Oh. Oh My.

*Munches Popcorn*

@zackwhittaker I'm most amused by AT&T calling *anyone* criminal.

Also, "Criminal Corporation loses Customer data...Again" is an equally accurate headline.