When confirming details of a massive data breach of about 110 million customers, AT&T on Friday also revealed that it became apparently the first enterprise to be given permission to initially keep breach details secret, and then was cleared to publish.
The incident itself — which AT&T said stemmed from a series of Snowflake attacks — revealed call data, but not the particulars of those calls. AT&T said that although the information stolen doesn’t reveal customer names, it pointed out that “there are often ways, using publicly available online tools, to find the name associated with a specific telephone number.”
AT&T spokesperson Jim Kimberly said in a phone interview with CSOonline that the stolen data, which was on a third-party workspace and spans the periods between approximately May 1 and October 31, 2022, as well as January 2, 2023, is not nearly at the detail level that, for example, customers are used to seeing in their AT&T phone bill. “Picture what is in your phone bill. (What was stolen) is not nearly that detailed,” Kimberly said. “It’s more like ‘this phone number contacted this phone number and were connected for this many minutes’.”
