InfoSecBulletin Cybersecurity for mankind
AT&T, an American telecom service provider, has confirmed a data breach. The data approximately 109 million almost all its wireless customers and customers of mobile virtual network operators (MVNOs) who use AT&T’s wireless network was accessed by threat actors.
AT&T’s MVNOs include Black Wireless, Boost Infinite, Consumer Cellular, Cricket Wireless, FreedomPop, FreeUp Mobile, Good2Go, H2O Wireless, PureTalk, Red Pocket, Straight Talk Wireless, TracFone Wireless, Unreal Mobile, and Wing.
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
“Threat actors unlawfully accessed an AT&T workspace on a third-party cloud platform and, between April 14 and April 25, 2024, exfiltrated files containing AT&T records of customer call and text interactions that occurred between approximately May 1 and October 31, 2022, as well as on January 2, 2023,” it said.
The company confirmed to BleepingComputer that the data was stolen from the Snowflake account between April 14 and April 25, 2024.
AT&T reported to the SEC on Friday that stolen data includes call and text records of almost all AT&T mobile clients and customers of mobile virtual network operators (MVNOs) for certain dates in 2022 and 2023.
The stolen data includes:
Telephone numbers of AT&T wireline customers and customers of other carriers.
Telephone numbers with which AT&T or MVNO wireless numbers interacted.
Count of interactions (e.g., the number of calls or texts).
Aggregate call duration for a day or month.
For a subset of records, one or more cell site identification numbers.
The records that were exposed did not include call or text content, customer names, or any personal information like Social Security numbers or dates of birth.
AT&T said customer data was “illegally downloaded from our workspace on a third-party cloud platform.” While the company did not specifically name the platform, multiple sources have linked the incident to a recent series of data heists from the Snowflake platform, where attackers compromised hundreds of Snowflake instances.
In June, security company Mandiant reported that a group called UNC5537 had hacked many Snowflake accounts. They did this by stealing customer login information with malware that infected systems not owned by Snowflake.
AT&T hasn’t found the stolen data available to the public yet and at least one person has been apprehended.
