AT&T remains silent on the online distribution of its customers’ information

In a series of events that have marked the cybersecurity sector for several years, the case concerning the potential massive theft of customer data at AT&T, the American telecommunications giant, continues to develop. It was announced this week that a complete set of data, initially leaked three years ago by a hacker, was posted online, exposing the personal information of around 73 million customers.

The disclosure of this data, including names, home addresses, telephone numbers, social security numbers and dates of birth, was authenticated following a new analysis. Several AT&T customers have corroborated the accuracy of their leaked personal data, adding a layer of realism to the situation. However, how this data leaked remains an unsolved mystery by AT&T.

The shadow of a doubt looms on the exact origin of the data. As of August 2021, the hacker in question had only shared a fragment of the data, making authentic verification difficult. AT&T then communicated that the information disclosed « did not appear to come from our systems », avoiding any speculation on its origin or reliability.

The case took a new turn when Troy Hunt, security researcher and creator of the site Have I Been Pwned, which specializes in reporting data breaches, got his hands on the complete dataset. After investigation, and by directly questioning AT&T customers, Hunt confirmed the reality of the leaked data. This corpus of data was revealed to contain 49 million unique email addresses and 44 million social security numbers.

Faced with these assertions, AT&T maintains its position, arguing via its spokesperson, Stephen Stokes, that « We have no indication that our systems have been compromised. » The firm suspects that the data posted online comes from an old collection, already seen on various forums and not emanating directly from its systems.

The origin of this data breach and how AT&T customer information was compromised remains unclear. As Hunt points out, it’s conceivable that this data comes either directly from AT&T, through third-party processing, or from another entity entirely. That said, resolution of this data breach case still seems a long way off, leaving AT&T without a clear answer on how its customers’ data was exposed.

This situation raises important questions about the consumer information security and corporate transparency in the face of data breaches. It is crucial that companies can not only effectively protect their customers’ data but also provide explanations and take responsibility when a breach occurs. The AT&T data saga illustrates the challenges telecom giants and their users face in an increasingly digitalized and vulnerable world.