An AT&T retailer in New York. The telecommunications firm stated Saturday {that a} information breach has compromised the data tied to 7.6 million present prospects.

Richard Drew/AP

cover caption

toggle caption

Richard Drew/AP

An AT&T retailer in New York. The telecommunications firm stated Saturday {that a} information breach has compromised the data tied to 7.6 million present prospects.

Richard Drew/AP

AT&T introduced on Saturday it’s investigating an information breach involving the private data of greater than 70 million present and former prospects leaked on the darkish internet.

According to information about the breach on the corporate’s web site, 7.6 million present account holders and 65.4 million former account holders have been impacted. An AT&T press release stated the breach occurred about two weeks in the past, and that the incident has not but had a “material impact” on its operations.

AT&T stated the data included within the compromised information set varies from individual to individual. It might embrace social safety numbers, full names, e mail and mailing addresses, cellphone numbers, and dates of start, in addition to AT&T account numbers and passcodes.

The firm has to this point not recognized the supply of the leak, at the least publicly.

“Based on our preliminary analysis, the data set appears to be from 2019 or earlier,” the corporate stated. “Currently, AT&T does not have evidence of unauthorized access to its systems resulting in theft of the data set.”

The firm stated it’s “reaching out to all 7.6 million impacted customers and have reset their passcodes,” through e mail or letter, and that it plans to speak with each present and former account holders with compromised delicate private data. It stated it plans to supply “complimentary identity theft and credit monitoring services” to these affected by the breach.

External cybersecurity specialists have been introduced in to assist examine, it added.

NPR reached out to a couple AT&T shops. The gross sales representatives in all circumstances stated they have been as but unaware of the breach.

On its web site, the telecommunications firm inspired prospects to intently monitor their account exercise and credit score experiences.

“Consumers impacted should prioritize changing passwords, monitor other accounts and consider freezing their credit with the three credit bureaus since social security numbers were exposed,” Carmen Balber, government director of the patron advocacy group Consumer Watchdog, advised NPR.

An business rife with information leaks

AT&T has skilled multiple data breaches over time.

In March 2023, for example, the corporate notified 9 million wi-fi prospects that their buyer data had been accessed in a breach of a third-party advertising and marketing vendor.

In August 2021 — in an incident AT&T stated isn’t linked to the most recent breach — a hacking group claimed it was promoting information referring to greater than 70 million AT&T prospects. At the time, AT&T disputed the supply of the info. It was re-leaked on-line earlier this month. According to a Mar. 22 TechCrunch article, a brand new evaluation of the leaked dataset factors to the AT&T buyer information being genuine. “Some AT&T customers have confirmed their leaked customer data is accurate,” TechCrunch reported. “But AT&T still hasn’t said how its customers’ data spilled online.”

AT&T is in no way the one U.S. telecommunications supplier with a historical past of compromised buyer information. The problem is rife throughout the business. A 2023 information breach affected 37 million T-Mobile prospects. Just final month, an information leak at Verizon impacted greater than 63,000 folks, nearly all of them Verizon workers.

A 2023 report from cyber intelligence agency Cyble stated that U.S. telecommunications corporations are a profitable goal for hackers. The examine attributed nearly all of latest information breaches to third-party distributors. “These third-party breaches can lead to a larger scale supply-chain attacks and a greater number of impacted users and entities globally,” the report stated.

Government guidelines adapt

Meanwhile, final December, the Federal Communications Commission (FCC) up to date its 16-year-old information breach notification guidelines to make sure that telecommunications suppliers adequately safeguard delicate buyer data. According to a press release, the principles intention to “hold phone companies accountable for protecting sensitive customer information, while enabling customers to protect themselves in the event that their data is compromised.”

“What makes no sense is leaving our policies stuck in the analog era,” stated FCC Chairwoman Jessica Rosenworcel in a statement relating to the adjustments. “Our phones now know so much about where we go and who we are, we need rules on the books that make sure carriers keep our information safe and cybersecure.”