Matthew Rosenquist breaks down AT&T's 2022 data breach that exposed call and text metadata for 109 million customers through a Snowflake vulnerability. AT&T paid $300k ransom to delete the stolen data. The risk is moderate: exposed phone numbers could enable phishing and social engineering, but message content and Social Security numbers were not compromised.
Chapters
As an AT&T customer, I did receive the unwelcome news that they suffered a data breach. Here's a rundown for what you should know. First off, let's cover the breach details. Now, this is a sizable data breach of about 109 million customers, somewhere in that ballpark, and the call and text interactions were captured from, uh, the first part of May 2022 through the end of October 2022. And right now, AT&T is blaming a third-party cloud platform, Snowflake, for some exploited vulnerabilities. They're not the only company that has suffered because of these Snowflake exploitations. Now, as of right now, the FBI is investigating, and one person has been arrested. Now, ultimately, the hackers accessed and exfiltrated the files sometime between April 14th to the 25th. And what is exposed is telephone numbers and phone logs. This is what was acquired by the attackers. But AT&T has been very clear in saying that call and text message content was not exposed. So that's kind of good news. Now, the breach does not contain any customers' personal information like birthdays or Social Security numbers, which AT&T actually does possess of its customers, but that sensitive data was not exposed. And apparently, AT&T paid the ransom, which really is not smart. We never ever want to encourage the attacker community by paying them large sums of money. Wired magazine reported that AT&T paid the hackers over $300,000 to delete the stolen information and then provide video proof, which you and I both understand can be fabricated, but okay. Now, when we look at the overall risk here, given that personal information was not really exposed other than the fact your phone number of your phone, if it was a mobile phone, also the cell tower location that it was being connected to, the risk is kind of nominal. So far, there is not conclusive proof that the data has actually been released in the wild, but that could change at any moment, right? We don't know if the data was really deleted, if it was stored, if it's going to be sold on the black market tomorrow or next year. We just don't know. We do know that if it does get released, we should expect a lot more phishing attacks to the phone numbers that are listed on those records because it showcases that these are active legitimate phone numbers that hackers should be sending SMS messages to or bad voicemail messages to or whatever, right? Social engineering attacks. Now, there could be some ramifications for those who need to keep their call logs secret in understanding who's communicating to whom, because you get to see the phone numbers of each party in these records. So think of undercover agents, uh, Supreme Court justices, cheating spouses, and all these kind of corner cases. That actually could have some potential impact on them, but probably not on the vast majority of us. Now, the geolocation data, which is part of the data breach, which identifies the cellular towers that the phones were connected to during the activities, is interesting, but likely not too valuable to attackers. Now, the SEC, right, the Security and Exchange Commission, they have rules for mandatory reporting of these kinds of things to shareholders. And there is a rule that says, hey, you have to report these within 4 days, but there are exceptions. And in this case, it was several months before AT&T officially reported this, but all the rules were followed because the United States government granted them twice 2 one-month delays to AT&T. So even though this, you know, was identified a while back, still AT&T absolutely followed the SEC rules for this. So we're not shaming them for that. They did the right thing. Now, AT&T has not deemed this breach to be material, and this is in the shareholder notice. So they're saying this is not a material financial event to the shareholders that the shareholders need to be worried about. But they did report it, which is good, right? So it is out in the public. Um, and I would agree with that. With this level of data exposure, it's probably not going to in of itself drive a lot of customers away. It's not going to reduce quarterly profits or things of that sort, market share, not in of itself, right? Overall, the scale of this breach Well, it's unfortunate, right? Where you've got over 100 million people's data getting taken, getting exposed, being put in the hands of criminals. But the sensitivity of that data really isn't that worrying in this case for the vast majority of the people that are affected. However, haha, this breach does show an unfavorable trend in AT&T security posture. Okay, so let's kind of look at the overall recommendations and issues that I see. AT&T says in the documentation that has been sent both on their webpage and in the letters sent to victims, right, that they, that protecting customer data is a top priority. Well, that just isn't true. I'm sorry, right? The reality is this is the second major data breach in just 3 months. Back in April, they also had 70 million other customers affected by a separate data breach. So yeah, their track record is not very good and it really kind of showcases some problems here. So as a cybersecurity professional, Let's talk about what I would love to see AT&T do. First, protect your data better, right? This is common sense. You need to be using multi-factor authentication. You need to be encrypting the data at rest. You need to clean up your access permissions. You should be instituting data blocking for exfiltration and enforcing data access at multiple points, like using zero trust methodologies, right? That's number one. These are basic things for any organization that has a large amount of sensitive private data, right? So do that, number one. Number two, remove all sensitive personally identifiable information, that type of data that you really don't need. Why do you need my Social Security number? My actual date of birth? I get it, you need to know whether I'm an adult, maybe how many years old I am, but my actual day, month, and year? Yeah, I don't like that. Um, the tower I most use during the day or evening. Do you really need to track that? You know, and nowadays, do you even need my home address? I mean, that's kind of questionable. For my mobile phone, I pay electronically. Do you really need to know where I sleep at night? No, you really don't. Remove these, and if some of these are gated or required by dated regulations, then drive the change in the industry to have those regulations updated for all the telecommunication vendors so they don't represent a collective weak point or target for data harvesters. All right, third, Implement a data destruction policy to destroy old customer data. Companies love to keep a hold of ancient data. Don't, right? Get rid of it. Do you really need to keep all those logs of people dating back a couple years? Probably not. Definitely not for billing. I would argue there is likely a mountain of data that you have but don't actually need to keep any longer. Clean that up, lighten up your servers, and focus on keeping your network up. So what's the long-term fallout here? Well, AT&T is getting proficient at handling major data breaches, which is not a compliment. I really hope that its big competitors lean into this and invest in their own cybersecurity to showcase how they can and will protect their customers, thus leveraging security as a competitive advantage for consumers to choose a communication provider that really is making customer data protections a top priority. And AT&T, I will be considering how you protect my data or don't when my contract is up and I look at other providers. Be sure to like and follow me on LinkedIn and Cybersecurity Insights channel, and we'll talk to you next time.
