Records of calls and messages made between roughly May 1 and October 31, 2022, as well as on January 2, 2023, are included in the data.
Nearly every AT&T cellular network customer’s call and text message records dating back six months were stolen by hackers, the firm revealed on Friday. This breach has the potential to expose private information about millions of Americans.
Through an internal investigation, the company claimed in an SEC filing that it discovered in April that hackers “unlawfully accessed and copied AT&T call logs” that were stored on a third-party cloud platform.
Records of calls and messages made between roughly May 1 and October 31, 2022, as well as on January 2, 2023, are included in the data.
Phone numbers were included in the records, but neither the messages nor the calls’ substance were accessed, nor the consumers’ private information stolen. This type of data, which is sometimes referred to as metadata and pertains to communications, is regarded as extremely sensitive, particularly when it is gathered and examined extensively to identify trends and relationships among individuals.
As per the company’s 2023 annual report, 127 million devices are linked to AT&T’s cellular network.
“While the data does not include customer names, there are often ways, using publicly available online tools, to find the name associated with a specific telephone number,” the business stated in its SEC filing.
Both the FBI and the Justice Department have stated that they are collaborating with AT&T to look into the attack. The FCC added that it had opened an inquiry into the security lapse.
Senior researcher John Scott-Railton of the University of Toronto’s Citizen Lab, which specializes in communications technology and security, referred to the hack as “megabreach,” stressing that metadata stolen at this scale has the potential to be a significant threat to national security in addition to being an issue for both individuals and businesses.
He made reference to the Edward Snowden leaks that revealed the National Security Agency’s mass metadata collection when he said, “These are extremely sensitive pieces of personal information and, when taken together at the scale of information that appears to be included in this AT&T breach, they presetent a massive NSA-like window into Americans’ activity.”
Also Read : Using Wegovy and Ozempic: analysis shows that after two years, most users discontinue.
Metadata can reveal personal information about an individual, according to Thomas Rid, a professor of strategic studies and the director of the Alperovitch Institute for Cybersecurity Studies at Johns Hopkins University. However, he cautioned that more information about the items that hackers stole from AT&T is required before a complete picture of the threat can be drawn.
“If you have somebody’s metadata, you know when they go to work, where they go to work, where they sleep every night,” he stated.
AT&T stated that it had “taken additional cybersecurity measures in response to this incident including closing off the point of unlawful access.” It stated that customers impacted by the hack will be contacted.
The business stated that, following an undisclosed amount of time, the U.S. Justice Department had ordered it to make public the specifics of the hack, which occurred between May 8 and June 5.
In an effort to help law enforcement apprehend the hackers, AT&T further stated that it is providing support.
The company stated, “Based on information available to AT&T, it understands that at least one person has been apprehended,” without going into further information.
Customers were reassured by the business that, as of Friday at the latest, “AT&T does not believe that the data is publicly available.”
Additionally, the document stated that the intrusion will not have an adverse effect on the company’s operations or financial outcomes.
The name of a person is not included in metadata by itself, even if it can be easily found online.
But because of a prior security flaw, the attack that was made public on Friday might even more dangerously affect AT&T customers. According to Jake Williams, vice president of research and development at the IT consulting firm Hunter Strategy, certain AT&T customer names were previously made public in a hack that was disclosed in March. Social Security numbers were also disclosed in that incident.
Also Read : The plague is among the worst bacterial diseases in human history.
“AT&T data previously compromised and released will help threat actors map a large percentage of the phone numbers in these customer records to the actual victims impacted,” Williams wrote in an email to NBC News.
The incident, according to a statement from Sen. Ron Wyden (D-Ore.), was a sign of the loose laws that govern the operations of telecom firms.
Also Read : The Paramount merger: Movie theater owners are concerned.
“This is not the first data breach revealed by a major phone company and it won’t be the last,” he stated. “Until the FCC starts holding the carriers accountable for their incompetence, these hacks—which are almost invariably the result of weak cybersecurity—won’t stop. These businesses will continue to compromise client security until they face fines amounting to billions of dollars.”
SOUECE : NBC NEWS
