AT&T says data from 109 million US customer accounts illegally downloaded

By David Shepardson

WASHINGTON (Reuters) -AT&T said on Friday the company suffered a massive hacking incident as data from about 109 million customer accounts containing records of calls and texts from 2022 was illegally downloaded in April.

The U.S. telecom company said the FBI is investigating and at least one person has been arrested after AT&T (NYSE:) call logs were copied from its workspace on a third-party cloud platform, in a significant breach of consumer communication records.

AT&T’s breach is the latest big hack to hit a wide swath of Americans, coming on the heels of a ransomware attack on UnitedHealth Group (NYSE:)’s Change Healthcare (NASDAQ:) unit in February that hit an estimated one-third of the country whose private data may have been exposed.

AT&T said the compromised data includes files containing AT&T records of calls and texts of nearly all of AT&T’s cellular and AT&T’s landline customers interacting with those cellular numbers between May and October 2022. The data does not contain the content of calls or texts or personal information such as social security numbers.

AT&T shares were down 1.2% in early trading. AT&T had delayed public disclosure of the hack at the request of the Justice Department.

The FBI did not identify any suspects on Friday but said it worked with AT&T and the Justice Department “collaboratively through the first and second delay process, all while sharing key threat intelligence to bolster FBI investigative equities and to assist AT&T’s incident-response work.”

The Federal Communications Commission said it also has an ongoing investigation.

The compromised data also includes records from Jan. 2, 2023 for a small number of customers.

AT&T said it first learned on April 19 that a hacker had claimed to have unlawfully accessed and copied AT&T call logs. The company said its investigation found hackers had between April 14 and 25 unlawfully exfiltrated files containing AT&T records of customer call and text interactions. The records also include AT&T customers of mobile virtual network operators using AT&T’s wireless network.

These records identify telephone numbers with which a wireless number interacted during these periods and aggregate call duration. A subset of records includes one or more cell site identification number.

AT&T said it has closed off the point of unlawful access and does not believe the data is publicly available.

In March, AT&T said it was investigating a data set released on the “dark web” and said its preliminary analysis showed it affected approximately 7.6 million current account holders and 65.4 million former account holders. The company said the data set appeared to be from 2019 or earlier.