Hackers stole call and text message records on “nearly all” of AT&T’s customers, the communications giant disclosed on Friday. The immense data breach took records of tens of millions of people’s phone use from around a six-month period in 2022, along with a single day in January 2023. According to AT&T, a suspect has been apprehended.
AT&T, which revealed the hack in a filing to the US Securities and Exchange Commission, stated that the data includes records of which numbers customers texted or called over a certain period of time, as well as the number of times the calls took place. The data doesn’t include other kinds of personal information associated with the numbers or information on what was said during the interactions.
“The data does not contain the content of calls or texts, personal information such as social security numbers, dates of birth, or other personally identifiable information,” AT&T said in the filing.
The company stated in its annual report last year that it had over 127m devices connected on its network, but did not state in the SEC filing exactly how many of these were part of the data breach. The Federal Communications Commission announced on Friday that it had opened an investigation into the hack, while AT&T stated that it was taking action to prevent future attacks.
“AT&T has taken additional cybersecurity measures in response to this incident including closing off the point of unlawful access,” the company said in its filing. “AT&T will provide notice to its current and former impacted customers.”
Although the stolen data did not include the names associated with the phone numbers, that information would probably be easy to reverse-engineer using online data brokers and public records. The hack also affected non-AT&T customers of mobile virtual network operators who were using the company’s wireless network.
The company learned about the hack on 19 April, according to the filing, and is working with law enforcement efforts to find the perpetrators. It follows another hack of AT&T’s data that it disclosed in March, which did contain the personal information, including social security numbers, of millions of users.
Cyber-attacks have continued to target major companies across industries throughout this year, with hackers sometimes holding data ransom or releasing it online. Ticketmaster is still reeling from a hack in May that affected about 560 million customers, and has resulted in hackers leaking ticketing information online while demanding millions of dollars in ransom payments.
