Posted on March 10, 2023 at 5:42 PM

AT&T alerts 9 million customers of a data breach after the vendor was hacked

AT&T notified around nine million customers that some personal details were exposed after a marketing vendor suffered a breach in January. The company noted that the breach targeted the Customer Proprietary Network Information for some wireless accounts.

AT&T alerts 9 million customers of possible breach

The company admitted to this data breach in a statement to BleepingComputer. However, it noted that the information the hackers stole did not contain personal details such as login credentials, credit card data, and other sensitive information that might have impacted the company’s operations.

“Customer Proprietary Network Information from some wireless accounts was exposed, such as the number of lines on an account or wireless rate plan,” the company said. “The information did not contain credit card information, Social Security Number, account passwords, or other sensitive personal information. We are notifying affected customers.”

The company’s notification about this data breach has not shared the number of customers that might have been affected. However, the company estimates that the breach might have compromised the accounts of around nine million wireless accounts if the attackers accessed their Customer Proprietary Network Information.

The CPNI data that was accessed because of this breach includes the first names of the customers, their wireless account numbers, wireless phone numbers, and email addresses. Such data being exposed to threat actors could be detrimental as it could trigger other hacking attacks, such as phishing campaigns where an attacker tricks users into accessing their accounts.

AT&T has also said that a small percentage of the customers affected by this breach had selected a rate plan. Therefore, the hacker managed to access the name of the selected plan, the amount that was due, the amount paid each month, the monthly charges, and the minutes used by the customers. The company noted that the information stolen by these hackers was years old.

According to the company, its systems were not affected because of the exploit that happened with the vendor. The company said that the data exposed because of this breach was largely acquired from the information that was shared about the eligibility to upgrade a device.  

AT&T alerted customers about this breach

AT&T said that it alerted law enforcement authorities about this data breach. The Federal Communications Commission mandates such reporting according to the company. “We have notified federal law enforcement about the unauthorized access of your CPNI as required by the Federal Communications Commission,” the company said in the notification letter sent pertaining to the breach.

AT&T has also said that this hacking attack was first detected by DataBreaches.net, and it was sent from att@message.att-mail.com. The company said that it had reached out to law enforcement authorities about this matter, saying that the report shared with them did not include any specific information about user accounts, and only mentioned that unauthorized access was shared.

The company has also shared an advisory with its customers informing them of the best way that they can mitigate against such attacks in the future. AT&T has advised its customers to toggle off the CPNI data sharing on their user accounts.

The company noted that the best way that customers can toggle off the CPNI data is by making the CPNI Restriction Request to lower the exposure risks in the future if AT&T uses the platform for marketing purposes for third-party vendors.

The company has yet to share more information about the type of information that was exposed because of this hacking campaign and the vendor whose network was breached because of the data being exposed.

Nevertheless, this exploit stresses the need for customers to be cautious about their operations to guarantee that they do not suffer from similar breaches in the future. The US corporate sector has been affected by hacking attacks that usually focus on stealing the personal information of users.

It is not the first time that AT&T has been targeted by a hacking attack. In August 2021, the company was also targeted by a hacking attack. However, at the time, the company denied this data breach.

In the breach that happened in 2021, AT&T said that a notorious hacker had auctioned a database that contained what the threat actor said was information belonging to 70 million AT&T customers. However, the company denied the accuracy of the information shared by the hackers.