InfoSecBulletin Cybersecurity for mankind
AT&T, an American telecom service provider, has confirmed a data breach. The data approximately 109 million almost all its wireless customers and customers of mobile virtual network operators (MVNOs) who use AT&T’s wireless network was accessed by threat actors.
AT&T’s MVNOs include Black Wireless, Boost Infinite, Consumer Cellular, Cricket Wireless, FreedomPop, FreeUp Mobile, Good2Go, H2O Wireless, PureTalk, Red Pocket, Straight Talk Wireless, TracFone Wireless, Unreal Mobile, and Wing.
Intel Issues Alert on 20+ Vulnerabilities, Urges Firmware Updates
Urgent: GitLab Patches flaws allowing unapproved pipeline Job Execution
Fortinet admits data breach after hacker claims to steal 440GB
Gov.t issues high alert on android devices
TD Bank fined $28 million for sharing customer data
Global-Cybersecurity-Index
Bangladesh secure role-model position by ITU
New RansomHub Attack Kill Kaspersky’s TDSSKiller To Disable EDR
Not Enough, Say Experts
India set to train 5000 ‘Cyber Commandos’
Researcher detect 21 New Ransomwares in August
Microsoft patch September 2024 fixes 4 zero-days, 79 flaws
“Threat actors unlawfully accessed an AT&T workspace on a third-party cloud platform and, between April 14 and April 25, 2024, exfiltrated files containing AT&T records of customer call and text interactions that occurred between approximately May 1 and October 31, 2022, as well as on January 2, 2023,” it said.
The company confirmed to BleepingComputer that the data was stolen from the Snowflake account between April 14 and April 25, 2024.
AT&T reported to the SEC on Friday that stolen data includes call and text records of almost all AT&T mobile clients and customers of mobile virtual network operators (MVNOs) for certain dates in 2022 and 2023.
The stolen data includes:
Telephone numbers of AT&T wireline customers and customers of other carriers.
Telephone numbers with which AT&T or MVNO wireless numbers interacted.
Count of interactions (e.g., the number of calls or texts).
Aggregate call duration for a day or month.
For a subset of records, one or more cell site identification numbers.
The records that were exposed did not include call or text content, customer names, or any personal information like Social Security numbers or dates of birth.
AT&T said customer data was “illegally downloaded from our workspace on a third-party cloud platform.” While the company did not specifically name the platform, multiple sources have linked the incident to a recent series of data heists from the Snowflake platform, where attackers compromised hundreds of Snowflake instances.
In June, security company Mandiant reported that a group called UNC5537 had hacked many Snowflake accounts. They did this by stealing customer login information with malware that infected systems not owned by Snowflake.
AT&T hasn’t found the stolen data available to the public yet and at least one person has been apprehended.
