AT&T Says New Hack Includes Records of Customer Calls, Texts

(Bloomberg) — AT&T Inc. suffered a massive hack of customer data — separate from one reported earlier this year — that included records of calls and texts for nearly all of its mobile-phone users for a six-month period in 2022, one of the biggest breaches of private communications data in recent memory.

Most Read from Bloomberg

The company said in a regulatory filing Friday that the breach, which hasn’t been previously disclosed, also included those records from customers of wireless service providers that used AT&T’s network between May 1, 2022 and Oct. 31 of that year. The company said it learned in April that the information was illegally downloaded from a workspace on a third-party cloud platform, which a spokesperson identified as Snowflake Inc.

Records from Jan. 2, 2023 were also compromised for a “very small” number amount of customers, the company said.

The data doesn’t include the contents of the calls and messages, personal information such as birth dates and Social Security numbers, or the times of the calls, according to the filing. However, the records “identify the telephone numbers an AT&T or MVNO cellular number interacted with during these periods,” according to the filing, referring to wireless service providers that use AT&T’s network. Although the data doesn’t include customer names, there are “publicly available online tools” that can connect numbers with people’s identities, the company said.

While much remains unknown about the breach, it has the potential — if the data is released — to be devastating for some customers. That includes anyone who doesn’t want others knowing who they are calling, such as politicians, executives, activists, journalists and their sources.

Bloomberg News reported on April 1 that personal data from about 73 million current and former AT&T customers was leaked on the dark web. That data appeared to be from 2019 and earlier and isn’t connected to the breach reported Friday, a spokesperson told Bloomberg.

On Friday, AT&T said it didn’t believe the information from the latest breach has been released publicly.

An investigation was initiated that included cybersecurity experts and steps were taken to close off the illegal access point. AT&T has been working with law enforcement, and believes at least one person involved has been apprehended, according to the filing.

Last month, Snowflake said that hackers had targeted its customers. The intruders used stolen login details to access the accounts of as many as 165 Snowflake customers — including Lending Tree, Advanced Auto Parts Inc., Pure Storage Inc. and Ticketmaster — and steal data. The hackers didn’t breach Snowflake but used credentials that were available in places like cybercriminal forums to access customer accounts, which lacked security measures such as multifactor authentication.

–With assistance from Charles Gorrivan.