InfoSecBulletin Cybersecurity for mankind
AT&T, an American telecom service provider, has confirmed a data breach. The data approximately 109 million almost all its wireless customers and customers of mobile virtual network operators (MVNOs) who use AT&T’s wireless network was accessed by threat actors.
AT&T’s MVNOs include Black Wireless, Boost Infinite, Consumer Cellular, Cricket Wireless, FreedomPop, FreeUp Mobile, Good2Go, H2O Wireless, PureTalk, Red Pocket, Straight Talk Wireless, TracFone Wireless, Unreal Mobile, and Wing.
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
Microsoft Patch Tuesday September 2026 Fixed 973 Flaws Fixed, 2 Zero-Days
“Threat actors unlawfully accessed an AT&T workspace on a third-party cloud platform and, between April 14 and April 25, 2024, exfiltrated files containing AT&T records of customer call and text interactions that occurred between approximately May 1 and October 31, 2022, as well as on January 2, 2023,” it said.
The company confirmed to BleepingComputer that the data was stolen from the Snowflake account between April 14 and April 25, 2024.
AT&T reported to the SEC on Friday that stolen data includes call and text records of almost all AT&T mobile clients and customers of mobile virtual network operators (MVNOs) for certain dates in 2022 and 2023.
The stolen data includes:
Telephone numbers of AT&T wireline customers and customers of other carriers.
Telephone numbers with which AT&T or MVNO wireless numbers interacted.
Count of interactions (e.g., the number of calls or texts).
Aggregate call duration for a day or month.
For a subset of records, one or more cell site identification numbers.
The records that were exposed did not include call or text content, customer names, or any personal information like Social Security numbers or dates of birth.
AT&T said customer data was “illegally downloaded from our workspace on a third-party cloud platform.” While the company did not specifically name the platform, multiple sources have linked the incident to a recent series of data heists from the Snowflake platform, where attackers compromised hundreds of Snowflake instances.
In June, security company Mandiant reported that a group called UNC5537 had hacked many Snowflake accounts. They did this by stealing customer login information with malware that infected systems not owned by Snowflake.
AT&T hasn’t found the stolen data available to the public yet and at least one person has been apprehended.
