AT&T customer account emails meant for multiple people were being delivered to a random woman's Gmail inbox instead. Robert Siciliano, a security expert, explains the risks when personal data gets fragmented across accounts. The woman reported the problem repeatedly before AT&T said it was fixed.
Chapters
"How would they get my email on all these accounts?" Barraged with email, a Rockland viewer says personal info tied to other AT&T customers keeps showing up in her inbox.
She reported it to AT&T, but the info kept coming, and it was time to call Curtis to investigate.
And we jumped right on this. We're talking about other people's account numbers, their temporary passwords, payment information, all showing up in her Gmail inbox. And she wants it to stop.
This one has an account number.
Emails appearing to be from AT&T about other customers' accounts. Pastu Tawana. Showing up in Carol Jan's personal Gmail account.
So 117 came in on one day.
Each email with small nuggets of info. Some with customer account numbers or user IDs. Some with temporary passwords. Others with partial credit card numbers or service information.
It's a lot of personal information that I don't want.
She's sure these other customers don't realize she's getting emails meant for them. But 3 months after reporting it to AT&T, the emails are still coming.
Their answer was, "We don't know what's going on." And AT&T could not tell us either.
What could the bad guys do with the information that this woman has received?
Unquestionably, little bits of data, little breadcrumbs, can add up essentially to a loaf of bread.
Security expert Robert Siciliano with Hotspot Shield compares the limited customer data in these emails to puzzle pieces. He says the bad guys can't put any information like this into databases, creating a full picture, which is a, a full comprehensive identity that ultimately can be used for various forms of fraud. Days after pressing AT&T for answers, the company will only say, protecting customer information is a top priority. We are quickly working to fix this issue isolated to this email address, and we will contact customers if any of their information was inadvertently shared. Carol worries if she's getting emails meant for others, who's getting her email? I just want it fixed. Now, we struggled to get a hold of the folks for whom these emails were intended. At this point, we don't know why Carol was getting them in the first place. Late this afternoon, AT&T said it is now fixed, but the company has yet to answer a list of questions we sent them, saying they are satisfied with the statement they shared. Have something for me to investigate? Go to CBS13.com/callcurtis and fill out our form.
