InfoSecBulletin Cybersecurity for mankind
AT&T, an American telecom service provider, has confirmed a data breach. The data approximately 109 million almost all its wireless customers and customers of mobile virtual network operators (MVNOs) who use AT&T’s wireless network was accessed by threat actors.
AT&T’s MVNOs include Black Wireless, Boost Infinite, Consumer Cellular, Cricket Wireless, FreedomPop, FreeUp Mobile, Good2Go, H2O Wireless, PureTalk, Red Pocket, Straight Talk Wireless, TracFone Wireless, Unreal Mobile, and Wing.
Check Point said BreachForum post old data
Apple Warns of 3 Zero Day Vulns Actively Exploited
24,000 unique IP attempted to access Palo Alto GlobalProtect portals
CVE-2025-1268
Patch urgently! Canon Fixes Critical Printer Driver Flaw
Within Minute, RamiGPT To Escalate Privilege Gaining Root Access
Australian fintech database exposed in 27000 records
Over 200 Million Info Leaked Online Allegedly Belonging to X
FBI investigating cyberattack at Oracle, Bloomberg News reports
OpenAI Offering $100K Bounties for Critical Vulns
Splunk Alert User RCE and Data Leak Vulns
“Threat actors unlawfully accessed an AT&T workspace on a third-party cloud platform and, between April 14 and April 25, 2024, exfiltrated files containing AT&T records of customer call and text interactions that occurred between approximately May 1 and October 31, 2022, as well as on January 2, 2023,” it said.
The company confirmed to BleepingComputer that the data was stolen from the Snowflake account between April 14 and April 25, 2024.
AT&T reported to the SEC on Friday that stolen data includes call and text records of almost all AT&T mobile clients and customers of mobile virtual network operators (MVNOs) for certain dates in 2022 and 2023.
The stolen data includes:
Telephone numbers of AT&T wireline customers and customers of other carriers.
Telephone numbers with which AT&T or MVNO wireless numbers interacted.
Count of interactions (e.g., the number of calls or texts).
Aggregate call duration for a day or month.
For a subset of records, one or more cell site identification numbers.
The records that were exposed did not include call or text content, customer names, or any personal information like Social Security numbers or dates of birth.
AT&T said customer data was “illegally downloaded from our workspace on a third-party cloud platform.” While the company did not specifically name the platform, multiple sources have linked the incident to a recent series of data heists from the Snowflake platform, where attackers compromised hundreds of Snowflake instances.
In June, security company Mandiant reported that a group called UNC5537 had hacked many Snowflake accounts. They did this by stealing customer login information with malware that infected systems not owned by Snowflake.
AT&T hasn’t found the stolen data available to the public yet and at least one person has been apprehended.
