AT&T data on ‘nearly all’ wireless customers accessed in hack
Unlock the Editor’s Digest for free
Roula Khalaf, Editor of the FT, selects her favourite stories in this weekly newsletter.
AT&T suffered a vast cyber security breach earlier this year, with hackers accessing the call and text message information of 110mn of the US telecoms company’s customers.
Over 11 days in April, “threat actors” accessed and copied records of customer calls and texts from a period of several months in 2022 as well as on January 2 2023, AT&T said in a regulatory filing on Friday.
The compromised data included files related to “nearly all” of its cellular customers, customers of mobile virtual network operators using its wireless network, and landline customers who interacted with those cellular numbers between May and October 2022. AT&T said the breach from January 2 affected “a very small number of customers”.
The data was held on the cloud platform of US software company Snowflake, but it said there was no evidence that hackers had exploited vulnerabilities in its systems.
“We have not identified evidence suggesting this activity was caused by a vulnerability, misconfiguration, or breach of Snowflake’s platform,” said Brad Jones, its chief information security officer. The company added that it had conducted investigations with third-party cyber security experts Mandiant and CrowdStrike to corroborate its findings.
It is the second cyber security incident disclosed by AT&T this year, following an episode in March. That also puts the Dallas-based group on a growing list of big US companies over the past 12 months that have contended with cyber security breaches, which includes healthcare giant UnitedHealth, consumer group Clorox, casino operators MGM Resorts International and Caesars Entertainment, and Supreme and North Face owner VF Corporation.
The US Securities and Exchange Commission last year imposed new requirements on companies to quickly disclose significant cyber attacks, albeit with exemptions that allow reporting to be delayed on national security or public safety grounds. The AT&T case is the first time a company has availed itself of such an exemption.
AT&T said it learnt of the breach on April 19 and that the US Department of Justice in May and June determined a delay in providing public disclosure was warranted. “We are co-operating with law enforcement in their ongoing investigation,” it said, and “as part of that effort, we delayed the announcement so as to avoid undermining their work”.
At least one person had already been apprehended, AT&T said.
The DoJ said it was investigating the incident, which, if disclosed more rapidly, would have posed “a substantial risk to national security and public safety”. The SEC declined to comment.
AT&T, the second-biggest wireless carrier in the US after Verizon, said it did not believe customers’ stolen records had been made publicly available. The data did not contain the content of calls or texts, or personal information, the company said.
It warned, though, that while the accessed information did “not include customer names, there were often ways, using publicly available online tools, to find the name associated with a specific telephone number”.
AT&T said it did not believe the incident was “reasonably likely” to materially affect its financial condition or results of operations. Its shares closed 0.3 per cent lower on Friday.
Under the SEC’s rule, when a company determines a cyber security incident is “material”, it must make a stock market announcement within four business days. But it may delay filing if the US attorney-general or a designated DoJ official determines that doing so would generate substantial risks to public safety or national security.
A DoJ official said companies should not fear coming forward early on. “The rule is not supposed to be set up as a ‘gotcha’,” the official said. Engaging with the authorities “does not trigger a determination of materiality and start the clock” for disclosure.
AT&T notified the FBI before determining the incident’s material nature, the DoJ said. Its “timely advance notification . . . benefited the department’s ongoing efforts to investigate the incident”.
AT&T said the customer data was downloaded from its workspace on a third-party cloud platform, and it had since closed off “the point of unlawful access”.
The company said in March that “AT&T data-specific fields” were contained in a data set released on the dark web but that it was not clear if the information was stolen from it or a vendor. AT&T had no evidence of unauthorised access to its systems, it said at the time.
The data in that case appeared to be from 2019 or earlier, affecting approximately 73mn current or former customers.
Additional reporting by George Hammond in San Francisco
link