Inside the Massive Alleged AT&T Data Breach

https://www.troyhunt.com/inside-the-massive-alleged-att-data-breach/

by gulced • 2 years ago

244 77 2 years ago

troyhunt.com

bloopernova• 2 years ago

Have any corporations previously tried to deny they were breached?

I'm wondering what AT&T thinks they'll achieve? If they're lying, that is.

ActionHank2• 2 years ago

I think that they realise that they can shift the burden of proof onto the accusers and call it a day. Unless the people behind the breach actually claim responsibility and allege it was AT&T that was breached, it's near impossible for anyone to prove them wrong.

supertrope• 2 years ago

The legal and PR teams just stick their heads in the sand. For example one could say "While there was unauthorized access there is no evidence that any personal information was taken." There's zero incentive to confirm the extent of PII leaks as it just triggers more liability and regulatory scrutiny.

explorigin• 2 years ago

Theory: AT&T has a known relationship with the NSA. Maybe the leak was due to an NSA screw-up. In that case, they're telling a half-truth but wouldn't be allowed to tell the whole truth.

azinman2• 2 years ago

The NSA screwed up and it ended up in the hands of someone who routinely hacks into large corps?

This doesn’t pass the basic smell test. I really don’t want HN to fall down the conspiracy hole that much of the internet now has. It’s eating away at our societal fabric and is wrong 99.9% of the time.

lionkor2• 2 years ago

Theory: Someone at AT&T suffered a traumatic brain injury, posted all this data, forgot about it, quit, and is now living in a cottage somewhere in the mountains of Canada.

ethbr1• 2 years ago

Since there's no required data custody trail (hint, hint: should be required in privacy legislation!), we'll never know.

But I expect the simplest explanation is, as the article posits:

1) ATT contracts out portions of its business operations to third parties.

2. Those third parties, in the course of their business, require and have access to customer information.

3 - One of those third parties was breached.

#4 ATT may or may not know. (Or may deliberately be not-asking their contractor)

Presto! Security by ignorance!

Given the access to SSNs, I'd assume something to do with private credit scoring.

Workaccount2• 2 years ago

My guess, with AT&T being an enormous and ancient corporation long past it's glory days, is that internally its a stale mess serviced by people unwilling to dive into it.

The breach did happen, but things under the hood are so bad that they have no idea it happened. The layers of incompetence and don't-give-a-fuck completely obscure the evidence. The IT team, staffed mostly by young green cards who weren't even in this country 3 years ago, stare blankly at AT&T's internal auditing system developed in the 90's with a long dead and strictly proprietary language. Doesn't matter because the system didn't even catch the breach anyway. As you move up the chain, people just get more divorced from reality as they live in the delusion of AT&T still being a forefront technology company. So of course the breach didn't happen to them.

At least that it my theory.

dogtierstatus• 2 years ago

Your theory is definitely plausible.

Source: Worked sometime for a subcontractor of a subcontractor of AT&T from a third world country.

Nextgrid• 2 years ago

That is correct. This kind of large legacy company has zero engineering culture. Engineering is not rewarded nor empowered to do its job well and is sometimes seen as a threat (engineering working too wall = entire departments could become redundant), which means nobody competent joins/stays there and only mediocrity remains.

bombcar• 2 years ago

Maybe we need a financial system where an unchangeable nine digit number is the passcode to unlimited credit. Maybe “instant credit” isn’t something we actually need as a society so we can have some more checks and balances. Maybe people shouldn’t be on the hook when banks idiotically loan to anyone with the magic number.

BramLovesYams• 2 years ago

But if we did that financial executives won't be able to afford that 5th vacation home! I'll stay here in the muck with my stolen identity incurred debt thank you very much. One day I'll tug these bootstraps hard enough.

pionar• 2 years ago

I got a notification from HIBP about this with my email address. I'm not currently an AT&T customer, but I was a customer of them back in 2015-2017 for AT&T UVerse.

najarvg• 2 years ago

Then likely your account info is exposed. I know a couple of former AT&T U-verse subscribers (not current) who's account info including SSN have been exposed

zhaso• 2 years ago

I got an interesting scam attempt the other day which was very similar to the one described in this AT&T forum post: https://forums.att.com/conversations/wireless-account/call-f...

Seeing this now, it makes a lot of sense how the scammers would know to target me.

tl;dr is that some scammers knew I had an AT&T account, and called posing as some AT&T branch that could only speak Chinese (ostensibly serving NYC Chinatown). I think they're targeting 2nd-gen Chinese speakers and forcing them into likely broken Chinese to throw them off guard.

Izkata3• 2 years ago

I've been with AT&T since they merged with Cingular in 2004-2006 or so, and according to https://haveibeenpwned.com/ I'm not included in this dump. However I didn't split my account from my parents until 2021 or so, so I'm not sure if I would have been or not if this was from before then.

Edit: My parents' email addresses aren't showing this dump either. Looks like we weren't included at all, so it can't just straight be all AT&T customers.

onedognight• 2 years ago

I too have been with AT&T since the Cingular merger and am also not in the HIBP db. I use a custom email address related to Cingular, which I otherwise would have forgotten existed.

nzealand• 2 years ago

I've been with AT&T forever, I've used a custom email address for AT&T since forever, and my email address is also not in the dump (I have a Premier account.)

EvanAnderson• 2 years ago

Same here. My 2004-era Cingular-specific email isn't in HiBP.

nickburns2• 2 years ago

keep in mind that HIBP doesn't offer any bare name, physical address, phone number, social security number, or birthdate lookup (at least as far as i can tell). i would take its utility regarding this breach with a grain of salt, and query the actual raw dataset if i wanted to be absolutely sure.

Izkata3• 2 years ago

According to the article:

As of now, all 49M impacted email addresses are searchable within HIBP.

EricE• 2 years ago

Just checked and I'm not in it either according to havibeenpwned.com, but was an AT&T customer for over 15 years and only recently stopped being an active customer.

observationist• 2 years ago

Your link is mispelled - HAV ibeenpwned and not HAVE ibeenpwned.com. It links to a malicious site.

alphabettsy• 2 years ago

It could be AT&T wireline/fiber only or something.

ttehr• 2 years ago

That looks to be the case since I'm not an AT&T wireless customer, but am a user of their fiber services.

aaronharnly• 2 years ago

According to this chart (whose source you have to pay to see, so unknown reliability), ATT Wireless has had well north of 150m customers in the date range in question, so it wouldn't be all of them.÷

cptskippy3• 2 years ago

I use a different email address for every service. I can confirm that my att@ email is in the dataset. So the data originated from AT&T.

TheDong• 2 years ago

I think what AT&T is saying is that it wasn't taken from AT&T servers. Rather, AT&T gave the data to some third-party data-processor (i.e. to some ad company), and that company then lost it.

... Honestly, that shouldn't really make us feel any better about them though, like why would AT&T give out data that includes SSNs to third-party data-processors.

bearjaws• 2 years ago

If this is true, and they sent SSN willingly to random third parties, they should be forced to pay for a decade of credit monitoring.

addandsubtract• 2 years ago

That's almost worse than leaking it themselves. There's also no excuse for sharing that data.

michaelcampbell• 2 years ago

Indeed, AT&T is more concerned about BEING breached as a first order than data under their responsibility got out... anywhere.

I doubt anyone affected will care about any such distinction.

butlike2• 2 years ago

But the static pieces of information like address, phone number, etc. can carry over between services. Is there any reason to suspect a Frankenstein breach, where only the subscriber email list was leaked, and the other data was correlated into personas, giving the impression it all came from one source?

cptskippy3• 2 years ago

They would need more than an email address to make a meaningful match in this case, since we're stating the email is unique to AT&T.

That being said, I've never heard of hackers performing Master Data Management but I guess it's possible. I'd hope they'd use something other than full name for their matches...

m463• 2 years ago

Same here. and I gave my name to them in a particular unique way. I have been getting phisting emails to that name and email addresss for a while now.

toast0• 2 years ago

My att@ address is also in the data set. I've used AT&T wireless, landline, and u-verse/fiber, all in California, but didn't think to use different addresses for them [1]. Additionally, in May 2023, someone attempted to open a Bank of America account using my att@ email address and presumably other details from the data. So that was fun.

[1] maybe the wireless was with cingular@ though, I think I signed on before AT&T reassembled, like the T-1000.

lionkor2• 2 years ago

I didn't now that subscribing to HIBP is free! Just for anyone else who assumed it would (maybe could) cost money

crotchfire• 2 years ago

if you aren't paying for it then you are the product being sold

janwillemb• 2 years ago

How do you think this works in case of HIBP?

butlike2• 2 years ago

who cares

mmsc• 2 years ago

If there is evidence that AT&T’s DirecTV was breached in 2021, what could the repercussions for them be?

annoyingnoob• 2 years ago

I've had cell service with ATT since at least 1998, with the same email address the entire time. I do not use any of ATT's other services, never have. I am not on this list.

x86a• 2 years ago

Same here, and my personal email is also not in the list.

However, my former work email, that I used to sign up for both U-verse fiber and a corporate mobile account, is on the list. I suppose that all happened in 2016-2018.

sargun• 2 years ago

I find it funny that companies like AT&T and Equifax are barely scrutinized for their data handling practices compared to the Amazon and Googles of the world. I wonder why that is.

thePhytochemist• 2 years ago

Yes! Equifax has very lax security. Last year they leaked my social insurance number to a fraudster. When they were describing this on the phone they didn't seem to think they did anything wrong. What makes it worse is I never even gave it to them - they just get it straight from the government I guess?

pksebben2• 2 years ago

They get it all kinds of ways. There's a podcast on their big breach that talks about some of them - https://spokemedia.io/breach/

pksebben2• 2 years ago

My first instinct was lobbying spend, but Amazon and Google show up in the top 20 and Equifax isn't on the list (although, I have my suspicions that the numbers here aren't necessarily the whole picture. Financial chicanery is a whole industry, after all). [1]

I can imagine, though, that hiding information is a lot easier when you're less often in the public eye. Amazon and Google, through their ubiquity, have a higher hill to climb when it comes to avoiding scrutiny.

1 - https://www.opensecrets.org/federal-lobbying/top-spenders

bashinator• 2 years ago

Just once, I wish a journalist would ask for a clarification wrt absense of evidence. "Are you saying you don't know or have no way of knowing whether there was a data breach?"

smarx0073• 2 years ago

I think encrypted DOBs and SSNs are the smoking gun. There may be no way to prove that '1996-07-18' DOB came from AT&T but it's quite hard to deny that the encrypted value '*0g91F1wJvGV03zUGm6mBWSg==' was produced by their systems (or not).

nickff2• 2 years ago

I don’t understand this comment, you say the encrypted values “are the smoking gun”, then at the end you say “(or not)”. Are you saying this happened, and the encrypted values show it, or are you just saying that they seem like evidence either way?

Even if we had AT&T’s keys, I think it might be non-trivial to verify that they correspond to this data, depending on how AT&T encrypts.

smarx0073• 2 years ago

Even if we had AT&T’s keys, I think it might be non-trivial to verify that they correspond to this data

What I was trying to say is that if AT&T systems (or a backup) contain that exact encrypted value (no need for a decryption key), it's a near-certain proof that the data came from their system.

then at the end you say “(or not)”.

Well, only AT&T DBAs/SREs should be able to confirm what I wrote above and I don't want to accuse anyone without proof. Same reason why Troy Hunt wrote "allegedly".

lulzury• 2 years ago

Consider getting in touch with your senator or representative [0] and also the FCC [1]. The recent changes we're seeing in other areas of the federal government give reason to stay a bit hopeful that the treatment of these kind of breaches don't stay the norm.

Lack of stewardship for folk's data should not just be the "cost of doing business".

[0] https://www.usa.gov/elected-officials

[1] https://consumercomplaints.fcc.gov/hc/en-us/articles/8824334...

trogdor• 2 years ago

What legislative changes do you think would significantly reduce the number of, or mitigate the impact of, data breaches?

AtNightWeCode• 2 years ago

I have not really thought this through but maybe there could be a forced requirement to add a watermark to the data when storing sensitive PII.

Hackers could then use the watermark to prove the authenticity of the data and users could use it to check if their data have been breached.

404mm• 2 years ago

One of my email addresses is listed in HIBP under the ATT leak. I haven’t had this address with ATT in 2021 and probably many years before that. Either the data doesn’t come from ATT or it’s really old. Unfortunately I cannot see the other details.. address would be a good point in time reference.

pjungwir• 2 years ago

I've personally also used identity theft protection services since as far back as the 90's now, simply to know when actions such as credit enquiries appear against my name.

I've always thought companies offer those for ulterior motives, e.g. maybe they get a fee for giving the protection service future customers. Do others use them? Maybe I've been wrong here.

ergonaught• 2 years ago

HIBP notified me I'm in this, but I haven't been an AT&T customer since early 2017.

Would love to see what's in it but, eh.

markstos• 2 years ago

I was an ATT (internet) customer at time of breach and don’t find any of my emails in Troy’s database.

megan_• 2 years ago

Reviews I saw about (arpanethack at gmail dot com) sounded much like a lie not until now you helped me to upgrade my worst semester result to upper credit I’m quite speechless thank you for your prompt service it was really top notch without traces text his mail above if in need of hacking services

Inside the Massive Alleged AT&T Data Breach

Related Stories