Data from nearly all customers of U.S. cellphone giant AT&T was downloaded to a third-party platform in a 2022 security breach, the company said Friday.
The incident took place outside of AT&T's network and the information taken was "aggregated metadata," according to a company spokesperson.
The stolen data contained phone call and text message records of nearly all AT&T cellular customers from May-October 2022. The records identify other phone numbers that AT&T customers interacted with during this time. While, according to the company, personal data like credit card information and Social Security numbers was not accessed and neither was the content of any calls or texts messages, it still may be cause for concern.
“If you have, say, 100 million of those records, technology can be used, especially with large language models or essentially OpenAI, to perform this relationship analysis,” said Peter Tran, chief information security officer with InferSight, a Boston-area security consulting firm. “Cyberattackers and cybercriminals can then begin to use that information ... for social engineering purposes: fraudulent, targeted texts or emails or phishing campaigns.”
Ericka Watson, founder of Data Strategy Advisors, shared more information on what that may mean for people whose information may be in the hands of hackers.
“With access to the call and text logs, that actor can piece together a compromised picture of an individual’s personal and professional contact and potentially lead to privacy invasion,” said Watson. “Another area is identity theft. The data can be used in combo with other publicly available information to impersonate that individual, leading to identity theft and other fraudulent types of activity.”
If you’re an AT&T customer, she said, you may want to screen incoming calls more closely.
“With this information I think that they, these actors, can be a lot more crafty in impersonating someone that you may know or even using a phone number that looks familiar to you to call your phone,” Watson said.
The AT&T breach is a good reminder that we should be proactive in protecting ourselves, said consumer advocate Edgar Dworsky, who founded consumerworld.org.
“It really is a huge number — we're talking about something like 110 million customers, but it's kind of another day, another data breach,” said Dworsky. “I mean, I'm sure everything about us is out there somewhere at this point.”
You should be monitoring all your accounts regularly and looking for any suspicious activity. Only open text messages from people you know and trust. Don’t reply to a text from an unknown sender with personal details, and always go directly to a company’s website. Avoid using links included in an unsolicited message. And remember, scammers can build fake websites using forged company logos, signatures and styles.
Also, remember to change your passwords regularly and turn on two-factor authentication for any device or application that has it available.
“You absolutely have to be alert,” said Dworsky. “Double check emails before you click … make sure you have a freeze on your credit reports. Just be careful. And unfortunately, these days, you have to assume your information is out there.”
If your information was a part of this AT&T data breach, the company says it will notify you by text email or postal mail. You can get more information on the data breach on the company’s website at att.com/dataincident.
