AT&T says criminals stole phone records of 'nearly all' customers in data breach

https://techcrunch.com/2024/07/12/att-phone-records-stolen-data-breach/

by impish9208 • 2 years ago

1103 801 2 years ago

techcrunch.com

smcin21• 2 years ago

This is huge; also AT&T knew on Apr 19 but only disclosed now; ongoing fallout from the Snowflake compromise:

- Records downloaded from Snowflake cloud platform

- "AT&T will notify 110 million AT&T customers"

- Compromised data includes customer phone numbers ("for 77m customers"), metadata (but not actual content or timestamp of calls and messages), and location-related data. Not SSNs or DOBs. Mostly during a six-month period 5/1-10/31/2022, but more recent records from 1/2/2023 for a smaller but unspecified number of customers. TechCrunch [1] has more details including Mandiant's response, the name and suspects location of the cybercriminal group

[1] https://techcrunch.com/2024/07/12/att-phone-records-stolen-d...

I wonder if Congress manages to summon TikTok-like levels of anger on regulating this one.

John238323• 2 years ago

And, honestly, how is this info (which I WOULD want to know) meaningfully actionable to customers. We get our information stolen from a myriad of sources everyday. These companies do comparatively nothing to make things right and the burden falls on customers to pick up the pieces if you're in a tranch that is sold and used.

smcin21• 2 years ago

Of course it's not meaningfully actionable to customers, big time lag in not disclosing since Apr 19. (Why does this not fall under SOX violation with the obligation to report timely to affected parties? It has affected AT&T's stock price -3% in early trading, so should it have also required SEC disclosure?)

Wondering what is the significance that most of the stolen records were from the period 5/1-10/31/2022? Does it mean that AT&T enabled 2FA on more recent records, or that more recent records were on a different cloud bucket (or that they mostly stopped using Snowflake since)?

Sylamore2• 2 years ago

Because AT&T reported it to the FBI and DOJ, they in turn requested AT&T to not disclose it and there are exceptions in the SEC rules for exactly that scenario of actively working with law enforcement.

Regarding 2FA, it probably means they just enabled it in their access rules for any access to snowflake, but it's highly unlikely AT&T will walk away from Snowflake anytime soon because it had become their preferred BI/Data Analytics platform and they were actively migrating several hundred TBs of data out of Hadoop to Snowflake.

lumb633• 2 years ago

This is another consequence of the surveillance state. The same data that can be used to surveil us by the government can be stolen by who-knows-who. We’d all (mostly) be far better off, IMO, if companies didn’t retain such records.

Jgrubb• 2 years ago

Yes but have you ever asked a dev if they actually need the 8 year old logs in some bucket?

rustcleaner6• 2 years ago

My wet dream would be a dump of all SMS or Meta or iMessage messages for a multiyear period for nearly 90% of users. Only when Normie Norman's private chats to his mistress and other little relationship trust disrupting secrets become uncensorably hosted on the darknet and freely searchable, only then will Normie Norman get a clue and install SimpleX/Briar/Cwtch/any other owner-free decentralized p2p chat.

dtx1• 2 years ago

While I share the sentiment, Normie Norman is not at fault. Meta and other BigCorps are the perpetrators and Norman the Victim.

LinuxBender2• 2 years ago

Not unrealistic. I used to have a tail of all SMS texts running 24/7 and was required to grep for specific terms for certain agencies until they eventually had their own access. This was only SS7 based texts and was long before RCS existed. I could have saved it all to my workstation but knew better than to do that. Either way SS7 and text messages are very insecure.

buro9• 2 years ago

Including all location metadata associated to that?

smcin21• 2 years ago

The reports said celltower-level location data associated with calls and texts (but not datestamps). That would allow inferring their homes, job location, commute, family members, social graph.

sitkack2• 2 years ago

You can still recover that without timestamps. It also looks like if anyone interacted with an ATT customer or used an MVNO your data is in there too.

akshayB• 2 years ago

The real problem is that data needs to be deleted over time. There is not much of a use case for customers for go back last year and see who called them and obviously there are use cases like criminal investigations or spying. But customer has no power or ability to dictate how long their records are store and how they are used. Companies should provide tools and features to their customers empowering them with their data.

tantalor• 2 years ago

This isn't data for serving user needs, this is data for spying on users

mountainb2• 2 years ago

Non-murder criminal offenses typically have very short statutes of limitations.

A lot of this could also be solved by encouraging the federal government to enforce federal privacy law as written more aggressively. A good incentive would be to amend the privacy statutes to permit the FTC to keep the funds extracted from settlements and penalties in-house. This would allow them to increase staffing and create a positive feedback loop to deter wrongdoing. This would have a negative effect on incumbent companies and practices, but it would not take long for the message to get across and for practices to change accordingly.

Congress tends to prefer keeping agencies on its own budgetary string which paradoxically limits what the agencies are capable of doing. The laws that we think protect us do not protect us because many of them are within the exclusive jurisdiction of a federal agency with very limited powers and funds. In the US the leadership likes to create the illusion that it has made "Bad Problem" illegal by writing it into the law, but it does not like creating the conditions in which "Bad Problem" could be solved, whether it's because the tradeoffs involved are tough to contemplate or because keeping "Bad Problem" around as a visible enemy is clever politics.

_heimdall3• 2 years ago

Non-murder criminal offenses typically have very short statutes of limitations.

There's a hidden assumption here. The expectation is that data retention and potential privacy violations are a necessary evil because anyone may later be under investigation for a crime. The data could go uncollected, it isn't AT&Ts job to retain private information on all of us just in case an investigator wants it.

Take telecoms out of it and consider a convenience store. Police would like to have video recordings of whatever moment in time they are investigating, but that doesn't mean the video has to be recorded and retained. A shop owner can choose to record videos and only retain them for a week if they want, or they can have cameras installed but not even recording if they're okay with just the effect of deterrence.

willmadden• 2 years ago

That's another bandaid. The root cause is customer data collection mandated by outdated regulation. People should be able to digitally sign or provide a public key for their personal information without providing the raw text to 3rd parties. Various 1970's style government tax and regulatory rules need to be updated as well.

softfalcon2• 2 years ago

They have a financial incentive to never delete your data. Storing old data forever creates a perfect paper trail to sell to advertisers and perfect the shadow profile they keep on all of us.

I agree that deleting all your data after a year makes sense practically, but they'll never do it because it makes them too much money to keep it around.

smcin21• 2 years ago

Ongoing fallout from the Snowflake compromise; AT&T knew on Apr 19 but only disclosed now (Why does this not fall under SOX violation with the obligation to report timely to affected parties? It has affected AT&T's stock price -3% in early trading, so shouldn't it have also required SEC disclosure?)

- Records downloaded from Snowflake cloud platform

- AT&T will notify 110 million AT&T customers

- Compromised data includes customer phone numbers, metadata (but not actual content or timestamp of calls and messages), and location-related data. Not SSNs or DOBs. Mostly during a six-month period 5/1-10/31/2022, but more recent records from 1/2/2023 for a smaller but unspecified number of customers. TechCrunch report has more details including Mandiant's response, the name and suspects location of the cybercriminal group

I wonder if Congress manages to summon TikTok-like levels of anger on regulating this one.

softwaredoug2• 2 years ago

Snowflake blamed the data thefts on its customers for not using multi-factor authentication to secure their Snowflake accounts, a security feature that the cloud data giant did not enforce or require its customers to use.

So AT&T put all our call information somewhere and hid it probably behind a weak password with no additional factors. IMO that's actionable negligence and I hope they get sued to oblivion.

smcin21• 2 years ago

I'm more stunned that AT&T knew back on Apr 19 [UPDATE: Mar 20] yet feels it had neither an SOX violation or SEC obligation (share price effect) to notify timely. Like, by Apr 22. Not three months later [UPDATE: 4 months later].

Remember the massive Yahoo 2014 hack which Yahoo management failed to notify its own users for 2 years?

If SOX violation only literally covers users' own passwords getting breached, but not 2FA or other passwords to access the same data, will Congress amend it urgently?

EDIT: apparently they're hiding behind the 3/20 disclosure [0] which is all they disclosed until [1],[2] today.

[0]: March 30, 2024 - "AT&T Addresses Recent Data Set Released on the Dark Web" https://about.att.com/story/2024/addressing-data-set-release...

"AT&T has determined that AT&T data-specific fields were contained in a data set released on the dark web; source is still being assessed...
"AT&T has launched a robust investigation supported by internal and external cybersecurity experts. Based on our preliminary analysis, the data set appears to be from 2019 or earlier [incorrect], impacting... approx 7.6m current and 65.4m former AT&T account holders"*
"Currently, AT&T does not have evidence of unauthorized access to its systems resulting in exfiltration of the data set.... As of today, this incident has not had a material impact on AT&T’s operations."* [but did it have a material impact on the customers/ex-customers?!]

[1]: Jul 12, 2024 - "AT&T Addresses Recent Incidents Regarding Access to Data" https://about.att.com/pages/data-incident.html

[2]: Jul 12, 2024 - "AT&T Addresses Illegal Download of Customer Data" https://about.att.com/story/2024/addressing-illegal-download...

"Based on our investigation, the compromised data includes files containing AT&T records of calls and texts of nearly all of customers of [AT&T’s cellular and (MVNOs) using AT&T’s wireless network], as well as AT&T’s landline customers who interacted with those cellular numbers between May 1, 2022 - October 31, 2022. The compromised data also includes records from January 2, 2023, for a very small number of customers. The records identify the telephone numbers an AT&T or MVNO cellular number interacted with during these periods. For a subset of records, one or more cell site identification number(s) associated with the interactions are also included."

amanaplanacanal• 2 years ago

According to CNN:

“The company said the US Department of Justice Department determined in May and in June that a delay in public disclosure was warranted. It’s not clear why that the US government requested that data be delayed. CNN has reached out to the Justice Department for comment.”

nimbius• 2 years ago

May 16 Dow Jones Industrial Average surpasses 40,000 points for the first time, before closing at 39,869.

public disclosure of a cataclysmic security breach in a darling of the stock market could have significant repercussions.

adamtaylor_13• 2 years ago

It definitely included SSNs for some of them.

Source: me. My data was included in the leak and it included my SSN. It’s been a cluster fuck of a cleanup.

wredue3• 2 years ago

My SIN number has been leaked no less than 4 times tied to basically every standard identifying question about me now, if that helps ease your worry.

I guess the new methodology is that a company cannot be sued if they just all leak data, that way nobody knows which one is responsible for your identity theft.

John238323• 2 years ago

How has Snowflake felt ANY recourse for being the source of all of these hacks?

beardedwizard2• 2 years ago

The dark web and info stealing malware are the source of the hacks.

My worry is not only that consumers get numb to breaches, but they consume rampant misinformation and have no idea how to hold appropriate parties accountable.

How many times have you held AWS accountable for stolen access keys?

Was it AWS fault when rabbit leaked their own keys?

Is it snowflakes fault when you lose your creds to infostealing malware?

How should snowflake enforce mfa on machine service account credentials?

The answers are no, no, and they can not possibly. Not even hyperscalers have this magic.

edm0nd2• 2 years ago

Eh, iirc the source of the hack was just regular stealers like Redline, not "the dark web".

It was actually Snowflakes fault.

The threat actors were able to find a test/demo account they could log into and from there they were able to access prod things they shouldnt have.

taspeotis• 2 years ago

Snowflake blamed the data thefts on its customers for not using multi-factor authentication to secure their Snowflake accounts

Aaronstotle• 2 years ago

its not Snowflake's fault their customers used weak passwords and no MFA. Not enforcing MFA does merit some blame on Snowflake, however, I still think its on the customer to secure your own environment.

smcin21• 2 years ago

Snowflake is saying they knew of unusual activity "around mid-April 2024", confirmed "May 23, 2024", around which time they made MFA mandatory (although their customer AT&T say they knew of the breach "Mar 20"; these timelines keep shifting back):

"Mandatory MFA option unveiled by Snowflake" - Jul 11, 2024 https://www.scmagazine.com/brief/mandatory-mfa-option-unveil...

"US cloud storage firm Snowflake has already required the implementation of multi-factor authentication across all user accounts a month following the widespread breach of customer accounts, including those of Ticketmaster and Santander Bank, reports The Register."

mewpmewp2• 2 years ago

It's industry standard to enforce MFA for customers of such sensitive data though. There's always going to be weak links.

chefandy6• 2 years ago

Right. Snowflake facilitated AT&T'S abject negligence, but ultimately the buck stops with AT&T, here.

dghlsakjg3• 2 years ago

Totally, way too many people are trying to blame snowflake.

ATT is a technology infrastructure company. Secure transmission of data is one of their core business competencies (theoretically). They are a corporation that we trust to handle incredibly sensitive info. Call records are, in fact, incredibly sensitive data.

They should be telling Snowflake what best practices to be using, not the other way around!

John238323• 2 years ago

I feel like this would be true if ONE customer was hacked. At this point it's more than a handful. AND snowflake knew about it.

If all the lockboxes in a bank get broken into, is it respectable to say "ah all of the customers should have used better locks"? The bank is the party who is supposed to be giving the insight into secure storage. They're not just renting space.

sickofparadox• 2 years ago

The Mandiant report said that some Snowflake customers declined to use MFA AND had passwords in place for 4+ years[1]. Maybe Snowflake should have pushed for MFA harder but at the end of the day, this is AT&T's fault.

[1] https://cloud.google.com/blog/topics/threat-intelligence/unc...

Ragnarork• 2 years ago

I'd say the blame lies halfway between AT&T and Snowflake. If you let your customers have poor security practices, and you have the power to ensure a heightened security level, you're also partly to blame...

wredue3• 2 years ago

Non-expiring passwords is probably no more or less secure, unless you are a rampantly terrible employer known for setting ablaze every bridge ever to the point of atomic annihilation.

softwaredoug2• 2 years ago

AT&T blamed an “illegal download” on a third-party cloud platform

WTF does this even mean?

The cloud employees downloaded it? If its so sensitive, why wouldn't this be heavily e2e encrypted?

JohnMakin6• 2 years ago

This is related to the snowflake breach. Snowflake is blaming customers for not enabling MFA.

tpurves• 2 years ago

Looks like more than enough blame to go around. Not enabling MFA is pretty egregious by ATT. Snowflake creating a platform where such a high consequence mistake is apparently easy to make, and obviously without sufficient compensating controls to detect or limit impact of such a single point of failure. That's egregious too.

rybosworld2• 2 years ago

Consumers are so numb to data breaches that these events now bring very little outrage. I think without that anger from the consumer, there's little incentive for companies to do more to stop data breaches from happening.

chefandy6• 2 years ago

Well it's starting to feel like data privacy just doesn't exist anymore. I don't know why administrators for big customer databases even bother setting passwords these days.

pavel_lishin4• 2 years ago

My mother was concerned that some of her information, and mine, leaked because she signed up for another bank account from a place she decided she didn't trust. She said she wasn't worried about the money being stolen, but she was worried about our identities being stolen.

My concern was the complete opposite - I assume that my social security number and address are already for sale for a fraction of a cent somewhere, bundled with 10,000 other identities. But if money gets stolen, that's a whole rigamarole, with banks wringing their hands and saying "identity theft" as if that clears them from any responsibility.

strangecharm22• 2 years ago

And why didn't they do anything when we WERE angry?

TeaBrain• 2 years ago

I think many companies think they can solve this issue by throwing money at their cyber security teams. It just happens that cyber security teams are often ineffective.

marcosdumay• 2 years ago

How could they? Everything related to computers is designed to exfiltrate data nowadays.

softfalcon2• 2 years ago

Maybe this is how it is at some places, but in my experience, it is not the case. I have friends who have worked in cyber-security for Fortune 500 companies and almost all of those companies would short-change (or outright ignore) the recommended spend and suggestions of their cyber-security employees, contractors, and advisors.

Where are you getting your information from? The levels of security negligence I hear about aren't even a big ask. Huge companies neglect to do basic things like "don't store your passwords in plain text" or "make sure you salt and hash your passwords".

I don't think it's fair to say cyber security teams are failing if companies are blatantly doing the worst and most obviously wrong things on the daily at the highest levels.

mrguyorama2• 2 years ago

It's hard for a CyberSecurity team to be effective when the Execs keep failing the phishing tests and IT does not have the authority to fire them for it.

kccqzy2• 2 years ago

Good security researchers easily command a $500,000 compensation package per year (cost to companies higher due to benefits like health insurance). When you show the market comp of good cyber security researchers to execs, suddenly they decide that they only have the budget to hire incompetent people.

Good cyber security people are expensive because they are highly skilled: they typically need to have been a software engineer to understand software architectures and have intuition about them, have spent significant time sharpening their skills at hacking by participating in CTFs, and have probably also spent significant time doing reverse engineering and have a few CVEs attributed to them. (Why are these skills needed? Because they are the skills needed by the red team. Every company that takes cyber security seriously will have a red team.) Now tell me whether these people are worth $500,000 per year.

kredd• 2 years ago

After Equifax debacle, I don’t think anyone cares. It’ll only be a big deal if there’s a huge B2B leak and business-critical data gets exposed, other than the usual name, address and phone number.

al_borland2• 2 years ago

I'm still upset the government hasn't started work on a new national ID program after the Equifax breach. The SSN is not a suitable ID number in this day and age. We need something better that can withstand these kind of things without screwing people for life. My credit will be frozen for the rest of my life, and everyone else should do the same.

chankstein382• 2 years ago

This is it for me tbh. Yeah I don't want my identity stolen and I'm still careful but after Equifax I just assume everyone already has my data so all of these data breaches are meaningless to me at this point. It sucks and it makes me mad but all I can do is shake my fist and wish these companies would be better anyway, so what else can I do but just be ok with it?

xyst8• 2 years ago

AT&T is a public company. Public company needs to get fined appropriately.

Start issuing multi billion dollar fines for these breaches and suddenly companies are invested in security.

Unfortunately with government agencies getting defanged as part of recent SCOTUS ruling, it’s likely not possible.

Have to rely on civil court to issue fines now (ie, class action lawsuits).

hughesjj4• 2 years ago

And this is yet another reason why I use signal

jacobwilliamroy4• 2 years ago

Do you exclusively use signal? Do your friends also use signal? Do you have friends who only use signal to communucate with you?

llm_trw7• 2 years ago

Yes.

rustcleaner6• 2 years ago

I am working on this with mine, but even Signal is too weaksauce in my book. Ownerless (and ideally decentralized) p2p chat is what I am after. If everyone in my group used Android then it'd be Briar or Cwtch hands down for primary text/picture msg and SimpleX or Session or Jami as voice/video call and backup. Because there's an iphone upsetting everything that scratches Briar and Cwtch, so it's SimpleX reinforced with Orbot on my group's menu currently and it seems to work reliably. Session has terrible notification delays when in the background, they use the [IMO] boneheaded send-on-select abstraction within the selection gallery when attaching an image on their Android app (oh and your unsent typed text is wiped). Very unprofessional, needs a bottom-up redesign for its interface. Really has that everyone quit feel to it.

hughesjj4• 2 years ago

Unironically yes. I'm in a bunch of different group chats with little overlap in signal. There was a huge push amongst my friend group to get people on it back in like 2015. I have some family not on it but we just talk in person.

Not everyone switched, but a surprising amount did, and only more have switched over time.

abixb• 2 years ago

I hope you didn't sign-up for Signal with an AT&T-tied phone number. Else this breach would've probably exposed your PII either way.

hughesjj4• 2 years ago

I did not, and even then, none of my call logs or texts via signal would have been included, regardless of carrier.

jen204• 2 years ago

This is the kind of breach that really should be company-ending, but will sadly instead likely result in a slap on the wrist.

It is high time for the US to have a privacy law with real teeth, and to enforce it with vigour.

Ekaros• 2 years ago

Class-action suit sounds reasonable, but sadly those never give penalties in right ballpark. Here it should be hundreds to thousands at least per affected customer.

But my guess it is few tens of cents, if that... While lawyer will get nice couple million pop...

criddell5• 2 years ago

Or maybe it's time to turn software engineering into an actual engineering profession. If the people responsible for designing and maintaining the AT&T system were "real" engineers, they could be sued for malpractice or even lose their license to practice.

ghaff6• 2 years ago

Do you really think that requiring 4-year degrees and passing a licensing exam would make a big difference? The fact is that, outside of civil engineering which involves a lot of dealing with regulatory agencies, most engineers in the US don't have PEs. I started on the path to get one because, had I stayed on my initial career path, I'd have been sending blueprints etc. to regulatory agencies but I ended up changing careers.

lesuorac2• 2 years ago

Snowflake still works though. What civil engineer has been sued because somebody jumped off their bridge? You get sued when the bridge collapses not when somebody uses it for an unintended action.

jen204• 2 years ago

The root cause is not whether engineers are licensed (I'm fine with that idea, but it's not going to resolve this specific problem). Instead, it is a culture of not caring about security because the fines are a cost of doing business is, and which comes from management, and treating personal information as an asset instead of a liability.

A Sarbanes-Oxley style law that makes the CEO personally criminally responsible for breaches will be vastly more effective than pursuing individual engineers - many of whom will be on the types of visa where they have no effective route of pushback on orders anyway.

JohnMakin6• 2 years ago

So where/what is my compensation? (I know there is no recourse).

When no one is on the hook for secure practices, like enabling MFA on your effin data stores that contain massive amounts of customer PII, this is the result. Not even an apology, just report it and move on. woops! those gosh darned cyber criminals.

criddell5• 2 years ago

If you go to court and ask for compensation you would likely be asked to show harm. Could you?

JohnMakin6• 2 years ago

It really doesn’t matter. Compensation has been dispensed to customers in data breaches such as credit/ssn info, no harm proof needed. Potential for harm is enough. Breach of contract, as a customer do I have a reasonable expectation that this data is not exposed? of course I do. No one could very seriously argue it’s a zero sum.

EarthLaunch• 2 years ago

Is there no harm, or is there harm that is hard to show in court?

latchkey• 2 years ago

I've received checks over the years for various things like this. You end up having to fill out a claim form and then wait about 5 years and one day, you get this check in the mail for some tiny amount of money.

floatrock• 2 years ago

In a statement, AT&T said that the stolen data contains phone numbers of both cellular and landline customers, as well as AT&T records of calls and text messages — such as who contacted who by phone or text — during a six-month period between May 1, 2022 and October 31, 2022.

AT&T customer? Prepare for phone calls / text messages from your most frequent contacts saying "I got stranded / I'm Officer Blahblahman helping your friend get home... please send gift card / venmo"

It's only metadata...

morkalork• 2 years ago

I guess everyone is going to learn what Snowden was worried about the hard way now. I imagine there's going to be extortion attempts over calls to abortion clinics etc.

smcin21• 2 years ago

Among other things. The data's mostly from May-Oct 2022.

rustcleaner6• 2 years ago

I just realized this is going to fvck my call blocking strategy up: now creditors will have a bank of known good numbers to spoof into my whitelist with! :^O

josefritzishere• 2 years ago

damn

ungreased06753• 2 years ago

So, AT&T wasn’t using MFA?

A lot of information can be derived from analysis of call records. If this information becomes public, it could be disastrous.

ffsm8• 2 years ago

If this information becomes public, it could be disastrous.

Isn't it even worse if it doesn't become public? It's been downloaded by an unauthorized party after all, so if they're not publishing the data, I'd wager they've found another way to profit from it. I.e. blackmail or similar.

I guess it depends on your viewpoint wherever that's better or worse.

xyzzy4747• 2 years ago

It's interesting when you have these old, large, sprawling bureaucratic organizations and the employees hardly give a sh!t anymore and allow for these large vulnerabilities. It's not a money issue, it's a caring issue I think.

hypeatei• 2 years ago

Our economic system is at odds with security because we're trying to "get by" as cheap as possible. That doesn't bode well for protection of users' data.

lotsofpulp4• 2 years ago

During the last decade, ATT’s leaders decided to burn tens of billions of dollars by overpaying for obviated businesses like DirecTV and Time Warner.

I can only imagine the quality of mobile and fiber networking we could have had if that money was spent on telecommunications. And maybe they would have spent a few million on having proper security.

aitchnyu• 2 years ago

Tangential, why did you/anybody spell "shit" like they are evading Tiktok language filters?

swarnie• 2 years ago

Why would AT&T even need to keep this data?

All i can think of is billing for a fraction of plans from the early 2000s who still pay per min/per text. Or maybe for capacity metrics but even then you only need the overall data point not the actual records once collaborated.

What's the US law for keeping data as long as its relevant and needed?

ilteris• 2 years ago

I am an ATT user and on a pixel which generally good at filtering spam messages. I have noticed I was getting so much spam messages recently ("wanna make money working remotely for x hours a day only") I was surprised and thought my number somehow made it to one of those spam networks. This confirms my suspicions.

bobo_legos• 2 years ago

Snowflake might want to take this page down in light of today's news.

https://www.snowflake.com/en/customers/all-customers/case-st...

cddotdotslash• 2 years ago

Another article[1] cites AT&T's Snowflake deployment as the source of the breach:

It’s not clear for what reason AT&T was storing customer data in Snowflake, and the spokesperson would not say.

[1] https://techcrunch.com/2024/07/12/att-phone-records-stolen-d...

smcin21• 2 years ago

AT&T stock has already bounced back from much of the initial -2.6% drop this morning, so the market thinks AT&T is immune. Meanwhile Snowflake is -3.9% down (they have many other customers than AT&T).

https://www.marketwatch.com/investing/stock/T

https://www.marketwatch.com/investing/stock/SNOW

jader201• 2 years ago

I never got the impression that the market ever cares about data breaches. It seems most companies are rarely held financially responsible for data breaches anyway.

I would bet any effects you’re seeing in stocks is unrelated to this news.

smcin21• 2 years ago

They are very much related to the news, that's precisely why I linked to the stock charts: AT&T was flat overnight but opened (9am ET) with a -2.6% spike down, but has been recovering since. Their press release appears to have been Friday 7am ET shortly before market open [https://about.att.com/story/2024/addressing-illegal-download...].

Also as corroboration here's MarketWatch: "AT&T’s stock slides 3% after company discloses hack of calls and texts" [https://www.marketwatch.com/story/at-ts-stock-slides-2-9-aft...]

graybeardhacker2• 2 years ago

I agree.

This is precisely why breaches keep happening and will keep happening. It cost money to implement security. There's no cost benefit to spending that time and money since there are no consequences.

Businesses do not spend money unless it will make them money or save them money.

There needs to be a hefty federal fine on a per-affected-user basis for data breaches. Also a federal fine for each day a breach is unreported.

That money should go into a pool which can be accessed by people who have their identity stolen.

chung8123• 2 years ago

I think they will care a lot more when it directly impacts them. If all their text conversations were publicly available that would cause some outrage.

rybosworld2• 2 years ago

There is some evidence that it does hurt stock prices:

https://www.comparitech.com/blog/information-security/data-b...

"Stocks of breached companies on average underperformed the NASDAQ by -3.2% in the six months after a breach disclosure"

That said, it's not clear what the long term impact is on stock price (if there is any).

weezin• 2 years ago

Really should be up to the government to fine these companies and pay out to those effected to disincentivize lax security standards.

nashashmi3• 2 years ago

Insurance takes up a lot of the fallout from data breaches.

darby_nine2• 2 years ago

I'm certainly not going to defend negligence of data protection but it's extremely difficult to cost as a liability (naively, you might even consider it not a liability at all) without government oversight.

hodgesrm2• 2 years ago

I never got the impression that the market ever cares about data breaches. It seems most companies are rarely held financially responsible for data breaches anyway.

This might also explain why there's little visible effect on other cloud database services either. After all, the attack is pretty simple and potentially affects any cloud database that allows access from the Internet.

omoikane• 2 years ago

My reading is that the market thinks Snowflake takes the majority of the blame, and the content of the linked article seemed to suggest as much despite having only AT&T in the headline.

lp0_on_fire• 2 years ago

The market doesn't care precisely because there is never any accountability.

blackeyeblitzar2• 2 years ago

The market correctly does not care because there is no consequence for the current or prior executives and no financial consequence for the company. All they will do is send out some obligatory notices, mention it in their investor relation materials, maybe offer a year of credit score monitoring, and move on.

We need regulations with massive fines, class action lawsuits (a ban on arbitration clauses), and maybe automatic minimum level compensation to those customers.

xyst8• 2 years ago

It’s priced in.

treflop• 2 years ago

Well it’s as if you put your data in Salesforce and Salesforce got breached… maybe you’re bad at picking vendors but the real loss of trust would be on Salesforce.

In this case, Snowflake was also the cause for the Ticketmaster and Lending Tree breaches according to the article so…

real lack of trust in Snowflake now.

ernestbro• 2 years ago

Snowflake is a platform. The lack of trust is in whoever configured Snowflake for AT&T

Credential rotation, SSO, PrivateLink or IP allowlists all should be used with PII.

yieldcrv• 2 years ago

its not an expensive problem and customers aren't going to go anywhere else

class action lawsuit just going to result in everyone’s $2 being given as a free trial of a ringtone addon from the early 2000s that converts into more recurring revenue

pylua2• 2 years ago

And earlier this year my ssn was on the dark web due to their leak (or vendor). One year of monitoring? No, I’m going to need it for life.

Security is not a concern. There is no real incentive to change the status quo. Make them pay for monitoring indefinitely .

ajsnigrutin• 2 years ago

I never understood the american secrecy about SSN... it should be a "username" not a "password"...

In my country you can calculate our own national id (mix of date of birth, autoincreasing number by each birth that day + 1 checksum number), and if you do/have any kind of personal business, your personal tax number has to be written everywhere, on every receipt you hand out or anything you buy as a business.

Somehow knowing that first boy born today will have an ID number of 120702450001X (too lazy to calculate the checksum, but the algorithm is public), doesn't help anyone with anyting bad.

ThunderSizzle2• 2 years ago

SSN is too public for it to be private or secret. Multiple employers, schools, medical institutions, financial institutions all ask for it, so it's not private.

It's also treated as evidence of who you are, but it isn't tied to identification like an ID is. These institutions use it without ever truly validating it.

It's similar to how records fraud can occur - people can record anything to the local registrar office, including fraudulent documents, without any checks. Once it's registered, it becomes evidence against the real owner. It's really messed up.

strangecharm22• 2 years ago

This comment pops up every time someone talks about social security numbers. Yes, they were never supposed to be private, but now they are. So either Congress can do something about it, or big companies can stop leaking them. Clever "well, actually"s didn't stop my identity from being stolen recently after a breach, and they never will.

browningstreet• 2 years ago

A lot of financial things in the US are “secured” or anchored by SSN, that’s the only reason why. That and mother’s maiden name and first vacation and other security questions. It’d be less important with MFA now but SSN is also needed when opening new credit, so having it allows you to pretty easily fake someone else’s identity for credit. KYC hasn’t removed it from the equation.

dylan6043• 2 years ago

Even the US gov't gave up on the notion the SSN was not to be used as an identifier. My dad's SS card had a phrase printed on it saying so. My SS card did not have that text.

alistairSH2• 2 years ago

I never understood the american secrecy about SSN... it should be a "username" not a "password"...

The problem is banks/financial services do a piss-poor job validating identity when issuing credit/opening accounts. "Oh, you provided an address, a SSN, and [non-random, easily discoverable personal fact]! Sure, here's a CC with a $150k limit!"

It's not the leak that's the problem; it's the ease with which that leaked data is used to either obtain fraudulent credit or access accounts.

I don't have a good answer, because at some point, a financial institution needs to trust people to do business. Customer loses their phone, so MFA doesn't work, ok, now what? I guess the customer needs to have one-time use recovery tokens saved somewhere that can't be lost? How many people do that (not nearly enough)? How many banks even issue those tokens? And what if the token store gets hacked? Now you're really fucked.

galdosdi3• 2 years ago

It's because it happened gradually / naturally / semi un intentionally, because:

1) SSN was not intended as a national ID, but it so happened to fit the shape of one, in that almost everyone has one and they're unique.

2) It has never been possible to institute an intentional national ID system in the US for political reasons

That is the recipe for the problem we have now. Strong demand for a national ID from many business purposes, the existence of something that looks a lot like, but is an imperfect form of, national ID, and the refusal to create a proper national ID, has naturally led to a de facto system of abusing the SSN as a national ID and just kind of everyone being a little annoyed and sketched out about it but putting up with it anyway for lack of alternatives.

Incidentally, did you know anyone can generate a valid new EIN (which is a lot like an SSN, and can be used where an SSN can be used for some but not all purposes, specifically filing taxes and ) at this page https://www.irs.gov/businesses/small-businesses-self-employe... ? This isn't legal advice and I'm not a lawyer and I don't know in what situations you personally would be legally permitted to use this (it's meant for businesses, absolutely not some kind of personal alias) -- but technologically, it's just honor system, and anyone can certify they need and are entitled to a new EIN and the IRS web site will provide you with a new unique one. I don't think you even need a legal entity, since you don't need a legal entity to run a business in the US.

galdosdi3• 2 years ago

Somehow knowing that first boy born today will have an ID number of 120702450001X

It's even worse. Only post-2011 IIRC births have an algoirthmic SSN. So everyone over the age of 13 still has old fashioned sequential SSNs, where XXX-YY-ZZZZ is determined by

1) XXX is the code for the office that issues your card. Can be guessed precisely and accurately by knowing birth location. For example, I can guess what region of the US you were born in (or lived in when you immigrated) by the first digit. 0 or 1 is probably northeast. 4 or 5 is probably near Texas. 7 might be near Arkansas. Etc.

2) YY-ZZZZ is sequential by date! So by knowing just birth day, can be guessed to within a range. In practice, this means it's easy to guess YY alone, but harder to get all 4 digits of ZZZZ

3) For some stupid reason it got popular to print SSNs with all but the last four digits masked. This is horribly bad because those four are ACTUALLY THE MOST SECRET PART! It's the only part that might not be guessable. But since it's common to be more lax with securing them..... it is super easy to recover the full SSN if you find a piece of paper that says something like

JOHN SMITH

123 Main St

Alabama City, AL 76543

In ref acct: XXX-XX-1234 (2001-03-14)

Dear Mr Smith,

Your account is overdrawn. Have a nice day.

Thinking of you,

The Bank

It also means if someone is personally known to me, even vaguely, I may be able to reconstruct their social seeing nothing but a scrap of paper that has just the last four, if I can guess approximately where and when they were born or first entered the US. If I'm in a situation where I can try several guesses, it's even easier.

demondemidi3• 2 years ago

When I went to college in the late 80s my ssn was automatically used as my student id. When I got my first bank account in 1990, they used my ssn as the account number.

buildsjets• 2 years ago

Our class grades with names snd SSNs were posted on the wall after exams in a list of hundreds of students.

Go Jackets.

mdavidn• 2 years ago

My first big employer in the aughts had my SSN encoded in a bar code on the back of my company ID, which they expected us to display at the office.

uticus• 2 years ago

It’s okay, will no longer be problem after Social Security Admin itself fails in next decade for being unsustainable

vundercind• 2 years ago

Why would that happen?

(Payouts are expected to drop in about ten years if no action is taken, but that doesn’t render the SSA irrelevant or cause it to suddenly collapse and shut down, so I assume you mean something else)

pixelesque• 2 years ago

SSN might be the least of the problems in some cases in terms of the info leaked...

What about people who have called suicide helplines, abortion clinics, loan servicing, etc...

With the numbers available, that will be possible to find out...

cwillu• 2 years ago

“Brad Jones, chief information security officer at Snowflake, told CNN in a separate statement that the company has not found evidence this activity was “caused by a vulnerability, misconfiguration or breach of Snowflake’s platform.” Jones said this has been verified by investigations by third-party cybersecurity experts at Mandiant and CrowdStroke.

AT&T said it launched an investigation, hired cybersecurity experts and took steps to close the “illegal access point.””

That's pretty rich: “it wasn't misconfigured, it was just illegally open, and now we're closing it”.

zomg• 2 years ago

when will governments hold these companies, but more importantly their executives, criminally liable for their lack of protecting customers' information?

hulitu3• 2 years ago

When they will not buy data from them. /s

mdale• 2 years ago

Interesting that they use the word criminals instead of hackers.. makes it sound like it was a physical heist rather than poor security practices on their part :)

demondemidi3• 2 years ago

They are criminals.

BenFranklin100• 2 years ago

This is a political problem. Until we pass laws that companies can be find liable for significant damages in the event of data breaches, we will see little progress on data security. This is an area where Congress needs to act. Current law does not adequately protect the public due to the difficulties in establishing standing, tying specific breaches to specific personal damages, other reasons.

Such a law would seriously impact current practices of the majority of IT firms, including small app developers, which is why we see little push from silicon valley for such changes.

abduhl2• 2 years ago

> AT&T said it learned of the data breach on April 19, and that it was unrelated to its earlier security incident in March.

Why was this not disclosed on AT&T’s earnings call on April 24? At least someone will get compensated for the breach, although it’ll be the lawyers for the class action lawsuit that’s about to hit instead of the customers that got their information stolen.

graybeardhacker2• 2 years ago

Freeze your credit people! It's super easy. It's not a perfect fix but it's so trivial to do and it will help.

https://www.usa.gov/credit-freeze

You can unfreeze through an app whenever you want/need to.

pavel_lishin4• 2 years ago

Is there any reason not to keep credit frozen permanently, only unfreezing it when you're making a large purchase that requires it?

noodlesUK• 2 years ago

Unfortunately it isn’t an option in every country. In the U.S., you can freeze your credit for free, but in the UK, you can’t. I think we should get rid of the CRAs entirely, but that’s a conversation for another day.

troyvit• 2 years ago

That's what I do. It also slows my roll. It's an extra step I have to take before making that large purchase or applying for anything that requires a credit check.

k4j8• 2 years ago

Keeping your credit frozen permanently is a great idea. Some of the credit agencies even encourage this with features such as a temporary unfreeze of your credit for a few days/weeks and then back to the permanently frozen state.

tnel77• 2 years ago

It’s a great idea! I only unfreeze my credit for big purchases like buying a house or car.

david422• 2 years ago

Yep. This is what I did after the first Experian data breach, for peace of mind. I am probably financially lucky enough that I don't need to constantly be checking or using my credit... but honestly it seems like this is what everyone needs to be doing.

lotsofpulp4• 2 years ago

I open credit cards for the bonuses frequently enough that freezing my credit would be more inconvenience than it’s worth.

Also, all the big bank websites seem to offer real time credit history monitoring for free, so I am betting I’ll just deal with any problem if/when they happen.

rqtwteye• 2 years ago

That’s what I do. But it’s a little bit of pain to unfreeze your credit with three bureaus when you want a new credit card. Wish there was a way to do this in one place.

al_borland2• 2 years ago

This is how I have operated ever since the Equifax breach. Once that happened, none of the others seemed to matter, everything important for identity theft is out there.

I've had no problems. Someone will try to run my credit, it will fail, then I ask which one they're trying to use, and I unfreeze it for a day. Some of them have the option to unfreeze for a single pull with a 1 time code (if I remember correctly), but when I tried to use that the person trying to pull the report seemed clueless, so I had to do the 1 day unfreeze.

kodt• 2 years ago

One interesting thing I ran into with frozen credit, is that you cannot sign up for USPS informed delivery without them running your credit as a method of address verification IIRC. If it is frozen the process gets stuck in limbo (at least it did many years ago when I ran into this situation)

nijave3• 2 years ago

As someone else mentioned, some authentication schemes require your credit to be unfrozen. This can include insurance companies (really any company that needs to verify your identity)

xyst8• 2 years ago

I typically don’t “freeze” my credit but do have a handful of services actively monitoring my credit for free (have been involved with many data breaches) and it’s included with my credit cards.

A credit freeze restricts access to your credit report

So if I freeze my credit, this will also deny access to the monitoring services AND financial institutions, right?

Side note: financial institutions often do “soft” credit pulls on active account holders to determine if they are eligible for credit limit increases. Have been growing my existing credit line for some time now without having to obtain additional credit cards. So far, close to $500K in unsecured credit.

Seems more like a nuclear option.

psadauskas• 2 years ago

Fuck that. I'm gonna open a bunch of credit cards, buy a bunch of cool shit, and when they ask me to pay my bill, just say my identity was stolen.

If I have to fight the credit bureaus anyway, I might as well get something out of it. Stealing my own identity seems pretty straightforward.

zzyzxd• 2 years ago

I keep my credit frozen all the time, but still keep getting alerts about new "no credit check" bank accounts from companies like chime.com. Then I give them my PII again just to verify and close those accounts, even though I don't have any business with them.

lfmunoz4• 2 years ago

what app or website do you use? Seems like you have to sign up for all three websites? Equifax Experian TransUnion?

therealmocker• 2 years ago

I couldn't find a reference to an app on the linked page, could you share more details on the app you use?

93po• 2 years ago

I was unable to get any of the three to verify my identity last I did this, and one of the three has never once in my 15 years of trying to get my free credit report let me actually get it.

nijave3• 2 years ago

I think you can go the paper route and mail something in to freeze

neogodless• 2 years ago

You can also freeze your non-credit banking:

https://www.chexsystems.com/security-freeze/place-freeze

It was recommended that I do this after a checking account was opened using my identity.

As others have stated, my default is "frozen." I put temporary thaws on when applying for credit, though in some cases, you'll be informed exactly which agency/agencies will be queried, and may not need to unfreeze all of them.

awad• 2 years ago

This is a great tip as most people only know of the big 3, thanks for sharing

currymj2• 2 years ago

i don’t think credit freezing matters too much in this case because the leak wasn’t tied to SSN, name, etc. that would be used for identity theft. it was phone call and location data. much worse for privacy but less useful for financial fraud.

monetus• 2 years ago

It sadly does matter for anyone who applied to work at advance autoparts , though. Their SSNs and the like are out there; the company's main database was hit.

slumberlust• 2 years ago

While this is good advice, it's important to remember that we shouldn't have to do this.

Credit companies take our data, without consent or compensation, then turn around and charge you if you want to prevent abuse of that collection. It's a racquet.

zsdfgyn• 2 years ago

Key point of the article:

"Snowflake allows its corporate customers, like tech companies and telcos, to analyze huge amounts of customer data in the cloud. It’s not clear for what reason AT&T was storing customer data in Snowflake, and the spokesperson would not say."

Finally journalists are asking the question why customer data must be stored with third party cloud providers. AT&T is a long way from Bell Labs, shame on them.

orochimaaru2• 2 years ago

All companies use third party cloud providers. A lot of legacy companies have been shutting down data centers to move to the cloud. So there isn’t a question of whether why your data is in the cloud. It’s going to be in the cloud.

sbarre• 2 years ago

And honestly, I think I'd rather trust cloud providers with the data than the remnants of a decimated IT team in a large enterprise that's struggling to maintain their own on-prem infrastructure that's super old and probably not up to date on patches.

ChrisArchitect• 2 years ago

Official support page: https://www.att.com/support/article/my-account/000102979/

jonplackett• 2 years ago

Unbelievable that they do not enforce 2FA for a client that huge. Absolute madnesss!

Sylamore2• 2 years ago

What's odd is until August of last year I worked for AT&T and had to do 2FA for accessing almost every internal site I used, and that extended to most SSO integrated external sites - including the relatively small number of Snowflake instances I worked with.

I do know that not every employee designation required universal 2FA but more or less all IT/ATO staff did.

MOARDONGZPLZ2• 2 years ago

Is this leak why the spam next messages have gone from “Hi how is your day ?” or “Hi [not my name] please do thing X. Of you’re not [not my name] I’m so sorry perhaps we can be friends.” to “Hi is this [my full name]?” or “Hello [my first name] how is your day ?”

jeffwilcox• 2 years ago

Any leak with your mobile and name pair could have done that. As a non-AT&T customer, I get the my-speecific-name pig butchering texts, too.

MOARDONGZPLZ2• 2 years ago

True. They’re brand new to me though. I’ve been getting the former for years, the latter for only weeks.

bediger4000• 2 years ago

That's an enormous amount of data. How do you not notice a huge, network-hogging data flow?

steelframe3• 2 years ago

That's an enormous amount of data. How do you not notice a huge, network-hogging data flow?

No it isn't. Not even close to some of the larger data sets that Snowflake most likely manages.

We're talking about the public cloud. You don't "hog" AWS's network with a one-time download in numbers like what we're seeing from the article.

Let's be generous and estimate that there are 1k records for each customer. That's almost certainly an overestimation for the time period that TFA specified, but for the sake of argument let's run with it. There are about 100M customers. So that's only 100B records. Assuming each record is on the order of 1kB in size, again likely a huge overestimation, then that would be just 100TB. AWS would charge $7k to egress 100TB, which would be a rounding error in AT&T's cloud spend.

The real amount is most likely less than half of that, if not a quarter.

the8472• 2 years ago

The headline could equally say "AT&T kept data for criminals to steal".

If wiretapping laws didn't exist then most of this data would not be justified to exist. Flat-rate billing doesn't need to keep track of this information. Even usage-based plans could keep cumulative records rather than individual ones, or at least delete them at the end of a billing period.

Where there is a trough, pigs gather.

throwaway120724• 2 years ago

There's no way to make the software perfectly safe from hackers and from social engineering. So, yes, companies should be more careful with the data and, yes, the data shouldn't be kept forever. I agree companies should be doing more to protect the data.

I see lots of outrage at the companies and why isn't the government doing more to punish them and how do I get compensated ...

But, I feel like everyone is blaming the victim. Is it the home owners fault when someone breaks in and steals stuff?

Where's the outrage at the hackers breaking into these accounts? Where's the "why aren't the governments tracking these people down?" Why is no one demanding that the hackers be brought to justice?

rightbyte• 2 years ago

But, I feel like everyone is blaming the victim. Is it the home owners fault when someone breaks in and steals stuff?
Where's the outrage at the hackers breaking into these accounts?

The internet is essentially every hooligan in the world about to kick in your dooor. So yes, I blame the home owner.

It seems silly to me to condemn anonymous users of the internet.

Back in the days when nothing of importance was done on the internet the view was way more healty.

If you have sensitive data, don't expose it to the hooligans. Easy as that.

metabagel2• 2 years ago

There's no way to make the software perfectly safe from hackers and from social engineering.

This is a straw man argument. Companies should use best practices in order to prevent most intrusions. When they do not, as in this case, criticism is warranted.

throwway1203852• 2 years ago

The problem with analogies is that they're a leaky abstraction. You're comparing a single person with maybe a handful of employees to a giant, multinational corporation with corporate offices, hundreds of thousands of employees, enough real-estate to create a small country, and billions of dollars per year in revenue. It's a false equivalence to compare this to door kicking like it was some kind of petty theft.

They literally kept everyone's information in a machine that was connected to the internet and then didn't make any effort to treat that with the gravitas it deserves. They are not the victim here, we are. It's a little shameful that you don't see that.

squeegee_scream• 2 years ago

It's ok everyone! Protecting our data is one of AT&T's top priorities.

Protecting your data is one of our top priorities. We have confirmed the affected access point has been secured.
We hold ourselves to a high standard and commit to delivering the experience that you deserve. We constantly evaluate and enhance our security to address changing cybersecurity threats and work to create a secure environment for you. We invest in our network’s security using a broad array of resources including people, capital, and innovative technology advancements.

I hope there's an enormous fine for this kind of negligence

nashashmi3• 2 years ago

Not their fault. Snowflake was breached. And the data was with Snowflake.

jeff_tyrrill2• 2 years ago

Your contractor being breached means you were breached.

hobs• 2 years ago

Snowflake was "breached" by AT&T users using the same password in Snowflake and another system that was breached.

This is just trivial pivoting done with some guesswork done fairly well.

nijave3• 2 years ago

Snowflake wasn't breached. A Snowflake database belonging to AT&T was breached.

jdgoesmarching• 2 years ago

That’s not how any shared responsibility model works

xyst8• 2 years ago

The “fine” will consist of a class action lawsuit that will eventually (3-4 years later) be bargained down to 1/2 the original claim. Lawyers take their 25% (or whatever cut was negotiated) fee. Then the impacted customers (assuming they submitted all of the claim paperwork) get paid out a few dollars.

panarky• 2 years ago

There may be no "good" telcos or big tech firms, but some are absolutely worse than others. AT&T is actively hostile in a way others aren't.

OutOfHere• 2 years ago

Unfortunate as it is, nobody genuinely cares about:

1. Preventing data breaches

2. Properly anonymizing aggregated personally identifiable data

3. Having and using a secure ID and verification system

gmd63• 2 years ago

They don't care because they don't know how the systems they use daily work, much less the costs and risks involved.

If they knew, they would care, and that's why representatives care on their behalf.

You could say the same about health and nutrition, but people very much do care when a medical issue tangibly affects them negatively.

mv4• 2 years ago

I am seeing this mentality as well, and it's disheartening. My company manufactures and sells a privacy-first, fully autonomous, on-prem, video security system for home and SMB. Yet, some people choose a cloud based service (convenient) and are surprised when their private data is either a) hacked, or b) abused by the provider's own employees (see the latest Amazon Ring settlement).

With the latest scandals and breaches though, I feel it's gradually starting to change.

stevetron• 2 years ago

AT&T bought into a significant amount of DirecTV - so much so that everything that had the DirecTV logo on it was changed to the AT&T logo, such as the invoicing. So the AT&T customer base has included, for several years, the Directv customer base. The article doesn't attempt to clarify who the 'nearly all' customers are, and some people will jump to the conclusion that it is the cell phone customers. But it could include the DirecTV customer base whose data is also at risk.

vel0city2• 2 years ago

AT&T didn't just buy into a significant amount of DirecTV, they owned DirecTV. As in, 100% ownership. So yes, all DirecTV customers were AT&T customers, because AT&T and DirecTV were not separate entities. It wasn't until 2021 that DirecTV was spun off into a separate company again, but still with 70% ownership by AT&T.

hermitdev2• 2 years ago

AT&T does a lot more than just cell phones. Probably also the largest US ISP behind Comcast, I'd expect. I had AT&T fiber to the home at a previous residence, and that was a great product. Far superior to Comcast.

skybrian2• 2 years ago

Snowflake blamed the data thefts on its customers for not using multi-factor authentication to secure their Snowflake accounts, a security feature that the cloud data giant did not enforce or require its customers to use.

And is that going to change?

dboreham3• 2 years ago

This is a diversion. Why did they build a system that permitted a bulk database dump of hundreds of millions of rows even with 2FA?

skybrian2• 2 years ago

Because that’s what a data warehouse is? You’d think they’d guard them more, though.

vel0city2• 2 years ago

Why did they build a system that permitted a bulk database dump of hundreds of millions of rows

Should all databases be capped at a few million rows total or something? I don't quite understand where you're going with this.

MisterBastahrd• 2 years ago

Be nice to have a new federal law: you get breached, you pay $5K plus lifetime credit monitoring to each person involved. Non-dischargeable by bankruptcy. No arbitration, no lawsuit. You pay.

joemi• 2 years ago

Interesting idea, though I think that having it be $5K (or any fixed amount) no matter the size of the company favors large companies, since large companies can probably spend more to reduce the risk of getting hacked. Hell, it might even incentivize large companies to fund hackers to breach their smaller rivals, in order to wipe out their competition.

kjellsbells• 2 years ago

I find it interesting that in your typical BigCo breach, they are at pains to point out that credit card details were not stolen. I infer from this that something about credit cards, and how they are secured, has real teeth and BigCo's lawyers are trying to stop them biting. Is this PCI-DSS? Maybe someone can comment.

As far as this breach goes, I think it just confirms my gut feel that Snowflake are heading to the wood chipper.

jeff_tyrrill2• 2 years ago

I think it's a desperate attempt to downplay the severity in any way plausible, taking advantage of the fact that credit card numbers and social security numbers have been mythologized in the American consciousness as nearly-mystical totems of identity and security, as part of the "identity theft" meme, even though they play little role in actual information security or privacy.

mensetmanusman• 2 years ago

Nice way to rule out who is a spy or not. Nice.

autoexec• 2 years ago

The company said the hack wouldn’t be material to its operations or negatively impact its financial results.

And this is why consumers will continue to see their information compromised by companies who collect and retain more data than they need and then fail to invest the time and resources to protect it.

JoshTriplett• 2 years ago

"AT&T reveals it has records of cellular customers calls and texts"

These records should have been deleted at the latest at the point where they're no longer relevant for billing. (Which also means that for customers with unlimited calling/texting, there shouldn't be any records in the first place.)

gumby2• 2 years ago

I believe this practice was followed only in postwar France, and I think even there has long been jettisoned. It's been a while since I got a French phone bill though.

xyst8• 2 years ago

AT&T is well known for working with NSA — 33 Thomas St [1]

[1] https://theintercept.com/2016/11/16/the-nsas-spy-hub-in-new-...

rockskon3• 2 years ago

That doesn't excuse this. If these records only existed so they could give them to the NSA at a later time, that further illustrates the dangers of accommodating the agency's desire for access to data generated from the U.S. Telecom backbone.

Cheer21712• 2 years ago

They keep all records for 7 years because the US Federal Government asked them to, not because they legally have to, but same with T-Mobile and Verizon: https://www.vice.com/en/article/m7vqkv/how-fbi-gets-phone-da...

pixl97• 2 years ago

Wasn't there some telco executive that was tossed in jail not long after 9/11 because he didn't want to play along with the government and keep data around forever?

clwg• 2 years ago

I wish that were the world we live in.

This is from the Snowflake breach, meaning this database was an "AI Powered Unified Data Platform." It almost feels like the erosion of our privacy is fueling the growth of allot companies.

I really hope that the boogeyman is real and all this was worth it.

gumby2• 2 years ago

The data can be used for traffic analysis (number->number call data); "no PII" except it's pretty easy to match a number to a likely user.

I'm an AT&T customer, and in my case I don't have a risk, but I can imagine this info could be very handy for divorce, custody, and corporate IP lawsuits. So worse than it might look to ordinary folks.

spacephysics• 2 years ago

Text meta data is an important distinction

Still not good, but headline feels clickbait if I think my text messages leaked

ethbr1• 2 years ago

That's still pretty gnarly in terms of social graphing though.

SoftTalker5• 2 years ago

"While the data does not include customer names, there are often ways, using publicly available online tools, to find the name associated with a specific telephone number"

In other words, your phone number and name is likely in a public record somewhere. It's not that private.

The info leak should not have happened but in the grand scheme of things it's not that big a deal. "The content of the calls and messages was not compromised." The worst it does is reveal who has been sending messages to or calling each other.

BobAliceInATree• 2 years ago

That metadata was can be terrible for many people like politicians, those having affairs, drug dealers or buyers, those with sensitive healthcare providers, and so on.

mass_and_energy2• 2 years ago

This. If you're in an abusive relationship and your abuser sees that you're calling a lawyer, a helpline, a family member etc, bad things can happen quite quickly. This information is non-public for a reason, and you don't have to be a drug dealer to be protected by it either.

CuriouslyC• 2 years ago

Big breaches like this are gonna be wild with advanced GenAI. Combing through the shit for the diamonds provided some degree of limitation on the impact of big breaches in the past but all those calls are going to be accurately transcribed and mined by AI and the attackers are going to have a buffet of products and targets laid at their feet.

mass_and_energy2• 2 years ago

It's just metadata, no transcription of calls can take place. In the future, please read the article before engaging in the discussion of its content.

nunez• 2 years ago

Metadata can be identifying enough. For example, given someone has this data and some local LLaMa variant on their machine, they could theoretically run a query like: "Give me all of the people that $NAME have called to, sorted by the number of times they called each other"

hulitu3• 2 years ago

It's just metadata

That's what they always say, honey, before calling the police. /s

II2II2• 2 years ago

My first question is: why was the data being stored by a third party in the first place?

Shouldn't data like this be stored completely independently of the Internet? Yes, I realize that does not guarantee it is secure since there has to be some point of access. On the other hand, it would reduce opportunities for people to breech the databases.

Cheer21712• 2 years ago

Because they don't care about actual information security, they care about "national security." They optimize for giving all branches of US law enforcement, from the federal to state to local level, access to 7 years of historical data whenever they claim they need it.

II2II2• 2 years ago

I don't buy into that theory, at lrast in this case. There are other ways to hand-off data when it is legally requested. On the other hand, such data would be valuable to foreign actors who do not have a legal means of accessing such data. It would require a high degree of incompetence to sacrifice national security in the name of convenience.

chasenjohnson2• 2 years ago

You would effectively be able to cross reference this meta data with 2 factor authentication services. It’s probably time to start removing this option entirely.

sedatk2• 2 years ago

How would cross-referencing be useful? You’d just find out what services people use?

rboyd• 2 years ago

I guess after mapping the services used you would find the accounts worth going for and those become SIM swap targets

chasenjohnson2• 2 years ago

If GitHub always uses the same number(s) for 2fa and there are outgoing texts to your number then the connection is obvious. I’ve read that sim jacking is somewhat common and this would be a good data point.

throwaway815232• 2 years ago

This happened in 2022 and they're just disclosing it now? Or did they just find out about it, which is maybe even worse?

JohnMakin6• 2 years ago

The data was from 2022. The breach was from april of this year.

tardy_one• 2 years ago

Who was the data being kept for?

molave• 2 years ago

The authorities requested the delay of the disclosure: https://cbs58.com/news/nearly-all-at-t-cell-customers-call-a...

mjevans• 2 years ago

These are all security nightmares aren't they? It smells as if all the resources went into delivering billing, then barely enough for technically working service, and then is there even anything leftover for security (instead of this being part of the foundation of a service)?

hateful• 2 years ago

Something happens when you tune your business only to the things you can measure.

I still (or at least try to still) have this naive opinion that if you make a good product, the money will come.

We sometimes spend too much time counting the beans and not enough time growing them. Not saying you don't need to count the beans, you do, but when your whole team is counting, they may forget to water them.

Also - to be on topic - don't forget to protect the beans!

blessedwhiskers• 2 years ago

The TechCrunch article indicates cell site identifiers were included, which means approximate location as well.

https://techcrunch.com/2024/07/12/att-phone-records-stolen-d...

dapearce• 2 years ago

No dates or timestamps included meaning they were using the data to build a social graph.

yiamvino• 2 years ago

I might be lone wolf here but I kind feel pity for ATT I dont know why they are solely getting all the loathe here . actual incident occurred on public cloud provider who had not provided secure tools practice to their customer. so in this customer getting blamed for buying service cloud provider lack of best practices.

smcin21• 2 years ago

Some new news in the article and comment:

- [security expert] "This [logs without timestamps] isn’t one of their main databases; it is metadata on who is contacting who. Its only real use is to know who is contacting whom and how many times."

- [commenter] "I have a theory that this call log was being used for a national security investigation. Otherwise why would this rise to the level of public safety/national security exemption?" [with two DOJ-approved 1-month delays for disclosure]

So, someone set up a separate Snowflake instance with mostly May-Oct 2022 AT&T data (90% former customers) apparently for that purpose. And left it up. Will anyone in Congress (e.g. Sen Ron Wyden) ask who did and why? (Another commenter on HN pointed out that Roe v Wade was overturned 6/2022, presumably that was not the intent of the original national-security investigation, but there's a potential for privacy abuse by the hackers' customers beyond everyday spam)

- In early 2023, Snowflake set up a unit especially for Telco data. But when you read the blurb (below), this product is not aimed at the telco's use-case; coincidentally this was also around the time Snowflake was touting integration with GenAI.

"Unlocking the Value of Telecom Data: Why It’s Time to Act" https://www.snowflake.com/blog/telecom-data-partnerships/

"Telecoms are the connecting tissue of the modern economy. They run everything... growing importance... hyperconnectivity.

What makes telecom service providers unique is that they have access to consumer location data. For most other industries, a consumer can go into their phone’s privacy settings and turn off the location access in the smartphone app. But in the world of telecom, as long as the phone is connected to a network, the telecom provider can use triangulation to find the approximate location of a consumer. This is why there is an emerging trend of companies [which ones?] building partnerships with telecoms to power use cases across multiple industries from competitor intelligence, alternate credit scoring, hyper-targeted marketing and more.

... Yet, despite the importance of telecommunications for society and in connecting industries, network operators are not yet fully embracing the value of the data they have at their fingertips"

But the value of this data (90% former customers) was clearly not to the telco itself... so who is the unnamed partnership and who is the end-customer? And was one of Snowflake's AI partners involved?

koolba• 2 years ago

Its only real use is to know who is contacting whom and how many times.

Which is exactly the type of info that would be used to find evidence of an affair.

Though this is specific to SMS so it would not include iMessage or other messaging apps.

nerdponx2• 2 years ago

Do organizations like Planned Parenthood offer SMS support?

axus2• 2 years ago

Didn't Congress already rubber-stamp AT&T sending the NSA this data?

riffic• 2 years ago

did they just enumerate an open web endpoint for it or something?

nerdponx2• 2 years ago

The data was stored in a cloud data warehouse called Snowflake, which had a major breach recently.

itscrush• 2 years ago

API based credentials are just username + password in this context, nothing else seems to be restricting access to data. So if your Snowflake tenant isn't enforcing IP restriction to limit source auth attempts, those creds can be used to pull the data from any source IP.

Even then, you'll still have an HTTP 403 response layer filtering those auth attempts based on IP... where we can assume these failed to implement it.

So far between TechCrunch, Wired, and other reporting it seems most claim creds get owned, sold, then used against under-restrictive Snowflake tenants which are exposed by default.

i.e; https://epa06486.snowflakecomputing.com/console/login#/ here's someone's tenant, if you were able to go buy some creds for it, should walk right in.

[edit] I have a more detailed Snowflake comment with references that might fill in better gaps here; https://news.ycombinator.com/item?id=40554753

lokar3• 2 years ago

You can use oath or rsa keypair for service account auth

gz54• 2 years ago

The root cause (1) is the data store should not have been available on the underlay network. Anything connected to an underlay network is a ticking time bomb.

Any servers or admins which need to talk to the data store should instead use a private overlay (2) network.

Any users (likely just remote admins) should do the same.

(1) Same root cause as 99% of breaches and yet it is too often swept under the rug while we focus on the infinite # of proximate causes

(2) Software, not private circuits.

jodrellblank• 2 years ago

It seems from the article that AT&T uploaded data to a cloud service, protected by username and password, and someone obtained credentials or breached the cloud service.

What does that have to do with 'underlay networks' and wow is that "the root cause of 99% of breaches"?

gz54• 2 years ago

An attacker who gets username/pw still can't get on the overlay network (the overlay requires credentials which can't easily be stolen or compromised, e.g. a private key signed X.509 certificate).

Yes, because 99% of attacks use the underlay network to access the target and exfiltrate the data. Said the other way, an attacker didn't physically walk into a Snowflake data center, console into the right server, and walk out with all the data.

jvanderbot• 2 years ago

I doubt they "breeched the cloud service" provider. They almost certainly exploited no 2fa controls on the clients access via the clients network, which is what GP was saying. If you're on a businesses network it's too easy to get at their cloud storage or dbs because they should be on a secure overlay network.

wmf2• 2 years ago

OP is using weird terminology. It would probably be clearer to say "Anything connected to the Internet is a ticking time bomb. Any servers or admins which need to talk to the database should instead use a VPN." which indeed was best practice until recently.

biggc2• 2 years ago

What? Has anyone published an RCA that confirms this? Is this how the data was ex filtrated from Snowflake? Or did ATT’s Snowflake credentials leak?

reaperducer2• 2 years ago

Software, not private circuits

If only AT&T had some kind of way for its computers to talk to one another without going over the public internet…

nequo• 2 years ago

@dang Could I ask why this topic gets systematically penalized in the HN ranking? There have been 15 submissions so far, I assume partly because previous submissions are not shown on the main page so HN users keep re-submitting it. This topic is both newsworthy and high interest.

(I was going to link to the 14 other submissions but the list is too long and it'd just come across as obnoxious.)

behnamoh• 2 years ago

The new HN voting mechanism is broken imo. Useless posts and articles of low value make it to the frontpage but valuable ones get shadowed.

arrowsmith• 2 years ago

There's a new voting mechanism?

nanidin• 2 years ago

At the moment this is #1 on the frontpage.

bloopernova• 2 years ago

The threads have probably tripped the flamewar detector. Certain amount of comments plus some other metrics will hide the thread from the front page.

DarkmSparks• 2 years ago

Isnt this just a legally mandated api for all phone operators in the US?

Edward Snowden published several slide decks about it a few years ago, before he defected to Russia.

not2b2• 2 years ago

It doesn't appear to be, though it was speculated that it might be. Companies keep all that data in the hope of making money by mining it.

wly_cdgr• 2 years ago

Why did it take them over a year and a half to disclose this?

u32480932048• 2 years ago

Something, something, national security?

smcin21• 2 years ago

The DOJ approved two 1-month "delay periods", first in May, then in June, as part of the criminal investigation. We found that out earlier this morning, see earlier discussion.

JohnMakin6• 2 years ago

It didn't. The breach happened in april of this year. The data is from 2022.

advael6• 2 years ago

It's disgusting that we still write headlines as "hackers steal" rather than "enormous company fumbles security for data they should never have retained"

SJMG• 2 years ago

That is a good reframe.

mrbluecoat• 2 years ago

How can I upvote this a million times?!

not2b2• 2 years ago

"It remains unclear why so many major corporations persist in the belief that it is somehow acceptable to store so much sensitive customer data with so few security protections."

It's because there are almost no consequences to them if they lose the customer data, beyond a day or two of bad press. If they faced significant fines, fines that get worse the more sensitive the data is, then they'd have an incentive to do better.

Jaygles• 2 years ago

No consequences, the cost can be great, and it can negatively impact productivity by introducing hurdles to legitimate uses. Those are immense pressures a soulless company will need to overcome to do the right thing.

fnord772• 2 years ago

so just metadata, not the actual texts or PII

macintux2• 2 years ago

“Just” is a dubious adjective in this context.

fnord772• 2 years ago

some of the reports make it sound like the hackers are reading everyone's salacious texts

wordpad25• 2 years ago

your phone number is PII and everybody you ever called or texted is VERY VERY PII

RyanAdamas• 2 years ago

Criminal charges need to be filed and class action lawsuit for fraudulent services for all the customers duped into renewing monthly services ignorant of the fact the service is not secure as plainly stated it must be in federal law.

advael6• 2 years ago

At the scale of this kind of incompetent failure, no human being should be on board with the narrative that we should be blaming "criminals" for this

If we don't hold companies accountable for keeping far more access and retention than should be legal, and securing their systems poorly, this situation will never get better

balls1872• 2 years ago

Who is the "we" here? And how should companies be held accountable?

It's very rare for someone at the highest level to be held to any kind of liability, and paying fines rarely, if ever, causes these too-big-to-fail corporations to materially impact them.

Strictly speaking about the US here.

advael6• 2 years ago

Needs to be at the level of enforcement by regulatory agencies, large scale lawsuits backed by state governments, and maybe even congressional action

These companies have scale as their moat and that's called a monopoly. We need to be aggressively pursuing corporate malfeasance, closing loopholes, and breaking up companies. In my ideal world the entire doctrine of the "corporate veil" would be overturned, but that seems unlikely to happen without drastic upheaval. Antitrust action and large-scale suits can happen and to some degree those wheels are already in motion, but it would help a lot to stop buying this bullshit about how we should think of this as a "crime" for which we should uniquely blame hackers. These megacorps want to pretend that they and their customers are in solidarity as victims of the hackers. In reality, these companies get hit with essentially none of the consequences, and their practices are most of the relevant causal factors. A better model would be that the customers (and often non-customers on whom they collect data without even the figleaf of manufactured consent) are victims of the companies and the hackers

slg3• 2 years ago

paying fines rarely, if ever, causes these too-big-to-fail corporations to materially impact them.

That means the fines aren’t big enough. They should probably be scaled according to the business’ revenue.

Animats2• 2 years ago

"still-unfolding data breach involving more than 160 customers of the cloud data provider Snowflake.'

So what is Snowflake normally doing with all that AT&T data? Redistributing it to "marketing partners"? Apparently. Snowflake's mission statement, from their web site:

"Our mission is to break down data silos, overcome complexity and enable secure data collaboration between publishers, advertisers and the essential technologies that support them."

So this was not, apparently, a break-in to the operational side of AT&T. Someone unauthorized got hold of data they were already selling to marketers. Is that correct?

biggc2• 2 years ago

ATT could be using Snowflake for internal analytics

smcin21• 2 years ago

It's not "internal analytics", because a) 90% of the data was former customers and b) it has location data but timestamps were removed, so it's social-graph information plus location. Start asking yourself what sorts of end-users want to pay for the entire social-graph of 77m, regardless whether those customers never make a phone call again.

"Alternate credit scoring, hyper-targeted marketing and more... an emerging trend of companies building partnerships with telecoms to power use cases across multiple industries." was the blurb for the unit Snowflake specially set up for Telco data in early 2023 touting "location data", but this product is not aimed at the telco's use-case; coincidentally this was also around the time Snowflake was touting integration with GenAI.

(It's not "competitor analysis" either, because if it was they would have obscured the 68m former phone numbers to prevent abuse by direct-marketing.)

[0]: "Unlocking the Value of Telecom Data: Why It’s Time to Act" https://www.snowflake.com/blog/telecom-data-partnerships/

lokar3• 2 years ago

It’s a cloud database, mostly olap. The ATT account was secured with a bad password and no mfa.

jetbalsa2• 2 years ago

Its not just a bad password, it was a password that was exposed to a info stealer in some way. It might of been reused or overshared into some system that got exposed. From what I understand someone got a huge info stealer dump and started putting two and two together and noticed all these scraped passwords and tried them on snowflake

jmspring• 2 years ago

This would probably be no different if someone like Salesforce had a breach and a large customer of theirs being impacted. There are large companies using SaaS services for a chunks of their back office stuff.

Root_Denied• 2 years ago

If that's the case then they're probably more upset that they're not getting paid for this data than anything else.

drcode• 2 years ago

break down data silos

[x] Objective Achieved

declan_roberts3• 2 years ago

I would like to sue AT&T in small claims for this and for leaking my Social Security number. But it's difficult to prove damages in these situations.

Does anybody have any advice? Proving damages means showing actual monetary harm.

josh-sematic2• 2 years ago

IANAL but this would seem like a “class action” situation.

vdqtp3• 2 years ago

I also ANAL but if I recall correctly, you can decline to be represented in the class, and file your own lawsuit

whalesalad2• 2 years ago

can't wait to get that check in the mail for $1.32

voxic112• 2 years ago

At&t customers are bound to individual arbitration so there will be no class action lawsuit for this.

Please read this Agreement carefully. It requires you and AT&T to resolve disputes through arbitration on an individual basis rather than jury trials or class actions.

https://www.att.com/legal/terms.consumerServiceAgreement.htm...

arcimpulse• 2 years ago

Very difficult to run these days. Since 2018, federal courts have ground away many of the legal routes needed to run a successful class action suit against a national or multinational corporation.

djbusby• 2 years ago

And look for Arbitration clause in your contract. Might limit your options.

declan_roberts3• 2 years ago

I was not a customer with AT&T when they leaked my Social Security number.

voxic112• 2 years ago

You likely cannot file in small claims and would need to pursue arbitration instead.

Please read this Agreement carefully. It requires you and AT&T to resolve disputes through arbitration on an individual basis rather than jury trials or class actions.

https://www.att.com/legal/terms.consumerServiceAgreement.htm...

quercusa• 2 years ago

- AT&T will usually pay all of the arbitration fees (with some exceptions).

That could get pretty expensive for them quickly.

1attice• 2 years ago

this breach is of course appalling. But nearly as appalling is the experience of _explaining why this matters_ to non-technical friends who stare at you with blank, distracted eyes, but only for a second; for their phone (yes, the very phone that just exposed them to uncountable future ills) has chimed.

I have nearly given up; like smoking, it will be decades before the harms are understood. We have to wait for your neighbour's brother to have died in a targetted political killing, because someone didn't like his Substack and borrowed the number and likeness of a friend; for his daughter's credit score to have been crushed by an anti-abortioneer who borrowed her face and likeness and number knew her first-grade teacher; for his son to die a death of despair, after making the wrong friends, and getting doxxed along with the rest of them.

This should be a five-foot headline moment. But no; CNN will lead with Biden-mumbles or Trump-grumbles.

How is it that the things that are killing us --- inequality, climate change, privacy collapse -- all have this same shape? Hamlets, all of us.

iftheshoefitss4• 2 years ago

I think humans are like corrupted, selfish and evil LLMs that like to think Utopia is possible if you think about it that way it’s super easy to understand

whyenot• 2 years ago

AT&T has 110 million customers. Let's be optimistic and assume that each customer only has to spend one minute of extra time managing their account due to the break-in. That is more than 209 years of lost time.

Laws related to data breaches need to have much sharper teeth. Companies are going to do the bare minimum when it comes to securing data as long as breaches have almost no real consequences. Maybe pierce the corporate veil and criminally prosecute those whose negligence made this possible. Maybe have fines that are so massive that company leadership and stockholders face real consequences.

pcblues2• 2 years ago

Personal data cannot be secured. The only way is to not store it. That will (imaginationaly) cost companies in lost revenue for being unable to mine and sell it. Only government can make laws against a company taking your personal information and selling it. Even passwords shouldn't be stored by a company.

The years of lost time argument is disingenuous. Over that number of people, 209 years of lost time from 700 million years of lives is nothing.

compootr2• 2 years ago

Whether or not it's disingenuous, it's our time that didn't need to be wasted in the first place by them not storing phone records

dopylitty2• 2 years ago

I’d take it a step further. If a technology is impossible to secure it shouldn’t be used. Maybe it’s time to rethink all the parts of our lives we’ve handed over to software.

tomComb• 2 years ago

There are lots of companies that take security seriously and don’t lose their customers data. Which is good, because there are companies that need to hold customer data.

Companies that don’t take security seriously and lose peoples data should be punished accordingly.

Companies that sell customers data should be identified.

But if we treat them all the same, then we let the bad companies off the hook, and punish the responsible companies unfairly.

voisin• 2 years ago

But hey, in 5-7 years there will be a settlement to the inevitable class action lawsuit and each of these customers (that fills in a form, ensuring only a small fraction actually do) gets a $3.75 credit on their next bill. The lawyers will get 30% of the settlement and each walk away with several million dollars. Justice! chef’s kiss

mandmandam2• 2 years ago

Idk man, the lawyers who made the rules say it's a great system.

Like, it might be an unending atrocity beyond all human comprehension, but, $666/hr soothes a lot of conscience and quiets a lot of tongues.

fshbbdssbbgdd• 2 years ago

If we go with the logic of the grandparent comment, where were can measure the harm by adding up a minute of time wasted across millions of people to get a big amortized number, it seems commensurate that each of those people can be compensated for their minute of wasted time with a few dollars.

banku_brougham• 2 years ago

This is deeply accurate

qingcharles• 2 years ago

This is from an email I got yesterday from PayPal:

"Google Referrer Header Privacy Settlement has sent you $0.11 USD."

wkcheng• 2 years ago

Yeah, you're right. Data breaches are essentially just slaps on the wrist to companies like AT&T. Maybe it's possible to fine them based on the proportion of the userbase that was affected and the profits they generated for a certain time period.

I wonder if this will push companies to stop using external vendors to store and process data. If companies stored all of their info in house, it would prevent the case where compromising one vendor compromises everyone's data. But it would also mean that each individual company needs to do a good job securing their data, which seems like a tall ask.

hnlmorg• 2 years ago

The reason some companies use external vendors is to outsource the risk.

ungreased06753• 2 years ago

I propose that the fines should be based on what the data would be sold for on a dark web forum. These breaches should be exponentially more expensive, which would incentivize companies to retain less sensitive data.

choppaface2• 2 years ago

The AT&T app and website are so bad it takes way longer than 1 minute to log in to e.g. pay your bill. The United States needs to raise the bar for large-cap negligent operators and fine the company enough to make shareholders listen.

AnthonyMouse8• 2 years ago

In approximately 100% of cases, if your intuition is to say "this company is too large should be fined/regulated more," what you should actually say is "this company is too large and should be broken into many smaller entities."

edanm3• 2 years ago

Laws related to data breaches need to have much sharper teeth. Companies are going to do the bare minimum when it comes to securing data as long as breaches have almost no real consequences. Maybe pierce the corporate veil and criminally prosecute those whose negligence made this possible. Maybe have fines that are so massive that company leadership and stockholders face real consequences.

I really dislike this attitude.

AT&T were attacked, by criminals. The criminals are the ones who did something wrong, but here you are immediately blaming the victim. You're assuming negligence on the part of AT&T, and to the extent you're right, then I agree that they should be fined in a bigger manner.

But the truth is, given the size and international nature of the internet, there are effectively armies of criminals, sometimes actually linked to governments, that have incredible incentives to breach organizations. It doesn't require negligence for a data breach to occur - with enough resources, almost any organization can be breached.

Put another way - you trust a classical bank, with a money, to secure your money from criminals. But you don't expect it to protect your money in the case of an army attacking it. But that's exactly the situation these organizations are in - anyone on Earth can attack them, very much including basically armies. We cannot expect organizations to be able to defend themselves forever, it is an impossible ask in the long run. This has to be solved by the equivalent of a standing army protecting a country, and by going after the criminals who do these breaches.

dwattttt• 2 years ago

In this analysis, the effort the bank puts towards defending themselves is relevant. We wouldn't blame the bank for an army attacking them, but if they left the door unlocked and the neighbours kids made off with your money you very rightly would feel differently.

mikeweiss• 2 years ago

Companies could also stop storing customer information for purposes unrelated to the core product that you are using..... But that's not going to happen because it's still far more profitable to mine customers data even with the risk of theft or breach.

hansvm• 2 years ago

I think the implicit assumption is that the vast majority of these breaches are obviously preventable (basic incompetence like leaving a non-password-protected database connected to the public internet is common).

A better analogy is not a bank defending against an army, but a bank forgetting to install doors, locks, cameras, or guards. _Yes_, the criminals are the root cause, but human nature being what it is it's negligent to leave a giant pile of money and data completely unprotected.

usea• 2 years ago

If a breach is so inevitable like you say, then it's negligent to store the information in the first place. They're accumulating and organizing data with the inescapable conclusion of handing it out to criminal organizations.

A4ET8a8uTh0• 2 years ago

<< AT&T were attacked, by criminals. The criminals are the ones who did something wrong, but here you are immediately blaming the victim. You're assuming negligence on the part of AT&T,

I am sure LEOs will do what they are paid to do and catch criminals. In the meantime, I would like to focus on service provider not being able to provide a reasonable level of privacy.

I am blaming a corporation, because for most of us here it is an ongoing, recurring pattern that we have recognized and corporations effectively codified into simple deflection strategy.

Do I assume the corporation messed up? Yes. But even if I didn't, there is a fair amount of historical evidence suggesting that security was not a priority.

<< Put another way - you trust a classical bank, with a money, to secure your money from criminals.

Honestly, if average person saw how some of those decisions are made, I don't think a sane person would.

<< But the truth is, given the size and international nature of the internet, there are effectively armies of criminals, sometimes actually linked to governments, that have incredible incentives to breach organizations. It doesn't require negligence for a data breach to occur - with enough resources, almost any organization can be breached.

Ahh, yes. Poor corporation has become too big of a target. Can you guess my solution to that? Yes, smaller corporation with MUCH smaller customer base and footprint so that even if the criminal element manages to squeeze through those defenses that the corporation made such a high priority ( so high ), the impact will be sufficiently minimal.

I have argued for this before. We need to make hoarding data a liability. This is the only way to make this insanity stop.

mangosteenjuice• 2 years ago

The customers are the victims, not the companies.

You picked the wrong point to counter with. The real problem is that the corporate decision-makers who bear the most responsibility will never be held accountable. They will always be able to shift blame to someone below them in the corporate hierarchy.

smcin21• 2 years ago

No, the root-cause is not AT&T were "attacked, by criminals"; there's a much wider issue involving Snowflake and multiple customers. The full facts are not in yet.

AT&T's data was compromised as one of Snowflake's many customer breaches (Ticketmaster/LiveNation, LendingTree, Advance Auto Parts, Santander Bank, AT&T, probably others [0][1]), which occurred and were notified in 4/2024 (EDIT: some reports says as far back as 10/2023). Supposedly these happened because Snowflake made it impossible to mandate MFA; some customers had credentials stolen by info-stealing malware or obtained from previous data breaches. Snowflake called it a “targeted campaign directed at users with single-factor authentication”. The Mandiant report tried to blame unnamed Snowflake employee (solutions engineer) for exposing their credentials.

How much responsibility Snowflake had, vs its clients, is not clear (for example, seems they only notified all other customers May 23, not immediately when they suspected the first compromise). Reducing the analysis to pure "victims" and "criminals" is not accurate. When you say "criminally prosecute those whose negligence made this possible", it wouldn't make sense to prosecute all of Snowflake's clients but not Snowflake too. Or only the cybercriminals but not Snowflake or its clients.

[0]: The Ticketmaster Data Breach May Be Just the Beginning (wired.com) https://news.ycombinator.com/item?id=40553163

[1]: 6/24 Snowflake breach snowballs as more victims, perps, come forward (theregister.com) https://news.ycombinator.com/item?id=40780064

bongodongobob3• 2 years ago

No way. If I were running a small MSP, I was breached, and my customers were infected I'd be sued out of business immediately. The fact that they are a titan means they should be that much more vigilant.

abdullahkhalids5• 2 years ago

The correct way is to follow what all other engineering and trade (medicine/law) already follow.

Some software engineers are licensed. A company must hire these software engineers, and any changes to what data is saved or how is saved must be signed by these engineers. If a breach occurs, an investigation occurs and if these licensed software engineers are found to be negligent, they lose their license. If they are found to be at fault, they get criminal penalties.

This, of course, must be coupled with penalties for management personals as well.

AnthonyMouse8• 2 years ago

This kind of system has consistent led to regulatory capture by the licensed industry. Even the mechanism of operation de facto assumes a significant gatekeeping barrier to getting a license, since otherwise companies would just pick one most willing to cut corners to save costs, or pay the license fee to get greenhorns certified because that costs less than adding two years to the development schedule to do it well. Making everything cost quadratically more than it already does is not a good solution.

What you want here is for them not to be holding the data to begin with. The solution to which is to just let customers sue them. Not for $0.30 and "free credit monitoring" but for actual money. Then companies can choose whether they want to mitigate their risk by doing actual security or by not storing the data to begin with, but most likely the second one is their better option.

erikaww• 2 years ago

If AT&T had spent more on security, this would not have happened. I absolutely do not believe individual engineers should be held liable.

tredre3• 2 years ago

I actually agree with you but this is a dangerous opinion to express on this forum, where move fast and break things is seen as the one true path.

hluska3• 2 years ago

You want a P.Eng (or equivalent) to sign off on anything that involves data? That won’t solve the problem but will dramatically slow down the pace of innovation. And all the while, it will funnel money further into regulated professions instead of into actually securing software.

This is precisely how we end up in a world where we’re all running twenty five year old software.

lolinder2• 2 years ago

Up until recently I agreed with this position because I, like you, thought that this was how licensed engineering disciplines worked. I thought that if you sign off on something you put your career on the line, making the potential penalty for signing off on bad designs worse than the one for saying no to a pushy boss.

Then the MAX crashes happened and Boeing is about to negotiate a sweetheart plea deal and there's absolutely zero talk of any of the engineering licenses that were used to sign off on the bad systems getting revoked.

If the licensing system doesn't actually include a threat of career-ending penalties for knowingly signing off on bad designs, or if the system allows executives to bypass engineer signatures, then it seems like the general consensus on here is right: it's useless overhead at best and regulatory capture at worst.

mr_toad2• 2 years ago

Where do you draw the line? Does that mean you need a license to write Excel formulas?

ikekkdcjkfke• 2 years ago

Are there any other analogies around 'endangering', because that's what happens when this info leaks to criminals

Kamq• 2 years ago

If you're going to do that, you're going to need to get universities to treat computers as an actual applied discipline. Physical engineers at least get some practice working with numbers around real materials.

I've met too many recent university graduates that don't even know you need to sanitize database inputs. Which, not their fault, but the university system as it currently exists in relation to software is not set up do do the thing you're asking.

The alternative is to have a really long exam (or a series of them like actuaries do?). Here are 10 random architectures. Describe the security flaws of each and what you would change to mitigate them.

The other change that needs to be made, is that engineers need to be able to describe the bounds of their software. This happens in the other engineering disciplines. A civil engineer can design a bridge with weight capacity X, maybe a pedestrian bridge. If someone builds it and drives semi-trucks over it, that's kinda their problem (and liability).

We would need some sort of way to say "this code is rated for use on an internal network or local only" and, given that rating, hooking it up to the open internet would be legally hazardous.

yummypaint3• 2 years ago

Hurting the shareholder is the only option to actually fix anything. Until the C-suite and board are forced to face the music caused by rich people being parted from their money, they'll just continue patting themselves on the back and giving themselves bonuses.

robocat2• 2 years ago

If bankruptcy can clear liabilities then your suggestion won't help. The shareholders are usually gone by the time the bill comes due: it's often cheaper to go bankrupt. And there's a whole private equity industry revolving around taking dirty liabilities and slowly bankrupting a company to squeeze the last dollar out before shutting down.

Look at the same problem with environmental disasters that were created by corporations. The problem with security liabilities is similar? Externalities are hard to get shareholders to pay for.

frogeyedpeas• 2 years ago

I agree.

Shareholders can vote and decide the direction of a company. They should also be held liable for any problems the company causes.

If the company is fined it should come out of company and then shareholder pockets. I might even add courts should be able to award damages by directly fining share holders.

If a company does something severely illegal then very large shareholders should risk jail time.

It’s your company after all as a shareholder. You own it.

It’s no different if your dog bites someone or child breaks the law. You have to pay the fines.

miki1232113• 2 years ago

The C-suite and board are not the shareholders.

The shareholders are mostly the pension funds that will eventually pay your money and the banks that already do.

gaze• 2 years ago

Everyone says what needs to happen. Every thread has this same exact post. We all know what needs to happen. How _would_ this ever happen? This is a board of innovators -- innovate!

geraldwhen• 2 years ago

No one here can force AT&T to spend more money on IT. If they do, even briefly, everyone involved will be laid off and outsourced within a few years.

kragen7• 2 years ago

we all know this does not need to happen, if 'we' are people familiar with the quality of software in already-regulated environments

devinplatt• 2 years ago

Penalties would also incentivise businesses to hide data breaches.

groby_b• 2 years ago

That is the worst case outcome of penalties, and it carries significant risk of whistle blowing. The default case will be compliance, because compliance is simply cost of business, something businesses understand well.

Meanwhile, currently businesses are doing shit all about data breaches except handing out the absolutely useless "2 years identity monitoring", so from a consumer view it really can't get much worse.

In general, the idea that penalties make people hide their bad behavior, so we shouldn't penalize bad behavior, is just extremely misguided. Because without penalties, we normalize bad behavior.

abduhl2• 2 years ago

Which should result in even larger penalties, hopefully those penalties can also be levied against the individuals that were associated with hiding the data breaches. Mid level manager that gets an email from Snowflake saying that there's been unusual activity who then hides that information or doesn't look into it? Fine 'em (and AT&T). Mid level manager tells a random engineer that DOES look into it and finds that they've been hacked but hides it? Fine AT&T and this person even more!

Buttons8405• 2 years ago

Make laws that protect whistleblowers from civil and legal penalties, punish those who attempt to illegally hide data breaches, including jail time in the worst cases. That would solve it. Individual employees don't care enough to hide it (they just work there), and leadership wouldn't dare risk a whistleblower which would cause them to face criminal penalties.

edflsafoiewq• 2 years ago

This appears to be an argument against law itself.

spixy• 2 years ago

GDPR has fines for data breaches

LocalH• 2 years ago

So you make it a crime to hide the existence of a data breach for more than X amount of time for the purpose of figuring out exactly what happened. I don't know off the top of my head how long X should be. 30 days? 60?

lumb633• 2 years ago

The people “whose negligence made this possible” are probably just rank-and-file employees. Careful what you wish for. I know I sure wouldn’t want to be legally liable if my software were vulnerable to something I didn’t know about.

Maybe a reasonable first step is third-party standards, audits, and certifications around data security to make privacy- and security-conscious consumers aware of what a company is doing. If consumers really find value in that, then they will preferentially deal with that company, and other companies will follow suit.

advael6• 2 years ago

Nonsense. The people who should hold responsibility are the people who have decision-making power and derive financial benefit from these choices. A rank-and-file employee is a scapegoat given the incentives at play in the system, even if they nominally wrote the vulnerable code

pjbeam• 2 years ago

My read of responsible people are corporate officers and executives--people who actually choose what to work on and are substantially rewarded by the corporation.

packetlost• 2 years ago

No, the people whose name is attached to budget decisions and higher level company direction that leads to this are the ones who are responsible.

eldaisfish• 2 years ago

this is already an established principle in other engineering fields. If a civil engineer screws up and a building collapses, both that engineer and the engineering firm are liable.

Why should the software industry be any different?

Buttons8405• 2 years ago

This reminds me of the story where someone accidentally deletes the database and there are no backups. Who's at fault? The individual IT employee who made a mistake, or the entire organization (especially leaders) who created a situation where one person could delete the database and there are no backups?

jonahx2• 2 years ago

The people “whose negligence made this possible” are probably just rank-and-file employees. Careful what you wish for. I know I sure wouldn’t want to be legally liable if my software were vulnerable to something I didn’t know about.

This isn't what's being suggested.

Higher ups set the incentive structures that result in dwindling security resources.

If their ass is on the line, they will actually listen to the developers and security experts telling them they are vulnerable, instead of brushing them off to divert resources that boost the reports which determine their bonuses.

dredmorbius6• 2 years ago

Direct liability to the front line / middle management which is cleared in exchange for defined levels of cooperation with criminal, regulatory, and civil investigations aimed at landing higher-ups would be a useful development.

ssahoo• 2 years ago

1. Absolute carelessness of customer data.

2. Nothing to no consequence to the executives.

3. Lawlessness of such events. Very poor consumer protection laws in this country.

4. Cybersecurity illiterate leadership making cybersecurity decisions.

5. Investing absolute little in Cybersecurity to meet bare-minimum standards.

6. Or all of the above?

bastawhiz4• 2 years ago

AT&T bought back a ton of shares of its own stock in March. It's likely that shareholders won't feel the effect of this security breach because of those buybacks (over a medium term time window).

How about instead of even more meaningless standards without teeth that don't affect the people pushing for profits over essentials like security, regulators impose punishments that actually affect the investors that ultimately create these perverse incentives in the first place? Nobody should be profiting off of a company that does wrong by over a hundred million people.

dheera• 2 years ago

Alternatively, we need sharper teeth around the consequences of this data breath.

Why are we using SMS for 2FA everywhere? Why does AT&T have to have residential addresses and KYC for all of its customers? These are the things that should be banned. The government official that mandated all this crap should be forced to sleep with scorpions for 9 years and stink bugs for 3 more years.

If so the leak would be of much less consequence.

trompetenaccoun• 2 years ago

It surprises me that there isn't a single comment pointing out that corporations like AT&T don't collect all that data for fun. This actually costs them a lot of money, but they're legally required by the government. While everyone is blaming the company, did you not take a second and contemplate how weird it is that you're fine with the government (and now everyone else es well) getting a record of all your phone activity? I'm old, back in my youth we'd have referred to that as a dystopian surveillance state.

23B1• 2 years ago

Pish posh. They also sell that data at an increidble markup – and without the knowledge of their customers – to anyone who'll pay, including governments and their cutouts.

Calvin02• 2 years ago

Banks are required to maintain financial transaction records.

Is the argument that governments don't have a good reason to mandate record collection?

Why can't I ask my government to keep me safe from terrorists but also expect that companies will not just be careless with the data they collect as part of that?

yupyupyups2• 2 years ago

That's a good point. Had they valued the citizens' privacy they would have done the opposite, that is make it illegal for network providers to store customer data that is not essential for them providing the services. But I guess creating a dystopian surveillance state is more of a priority.

hluska3• 2 years ago

Why they hold it and how they protect it are valuable conversations. But their customers deserve something akin to security regardless of the why.

rsingel2• 2 years ago

There's no federal law requiring AT&T to hold onto this data.

There's possibly a FISA court requirement (too secret to reveal), but AT&T has long been an exceedingly willing part of the gov's spying apparatus. It fed these records and Internet data to the feds without any court order, and only escaped legal troubles when Obama, contrary to his campaign promises, gave AT&T, Verizon and more retroactive immunity

bastawhiz4• 2 years ago

Being required to do something doesn't justify doing it poorly. AT&T brought in over $3 billion with a B of profit with a P in Q1 2024. They have more than enough money to secure their systems. They're not struggling. In March of this year they bought back 157M of their stock. They could have instead put that money towards security, but they didn't: they put it towards enriching shareholders.

0xcde4c3db• 2 years ago

I've never heard of this, and cursory web searches don't seem to be turning up anything relevant (although that's admittedly not saying much with the state of search lately). Can you explain how the law requires this level of data retention?

sp312tol• 2 years ago

how weird it is that you're fine with the government getting a record of all your phone activity

I don't like it, but accept it as the lesser evil. I'm from Europe and I believe the number of reported prevented terror attacks. The agencies need data access for that. Not good, but necessary.

But are you aware that Meta, Google, Apple, MS, etc. collect every kind of information about every user of Android, iPhone or WhatsApp, Insta, Facebook, Windows? Phone manufacturer, huge apps like TicToc as well. The kind and size of that data is crazy beyond imagination. I don't care if the government can get access to my WhatsApp messages when some of the most irresponsible companies, collect and use everything to their advantage. Are you really that naive and think that Meta doesn't analyse their gigantic data lake including billions of WhatsApp messages to predict the results of elections? That is the real danger to democracy.

xethos2• 2 years ago

Sure - pretty well every corporation you purchase a service from is required to store your credit card information as well. But there are stiff penalties from the government and credit card processors for unauthorized access to that information; consequently, it's rarely stolen.

Your address, cell metadata, phone number, email address, and passwords are leaked pretty well contsantly though.

It's not that corporations are incompetent. The laws and regulations mean it's not worth the cost to treat your personal information with any real respect.

Aeolun• 2 years ago

The government isn’t distributing my data to everyone else (so far). For profit companies have a pretty massive list of breaches so far.

wraptile• 2 years ago

"legally required by the government" to keep securely. If you can't keep to the rules don't play the game. I'm sure any other telecom would be glad to get the market share.

sulandor• 2 years ago

do yourself a favor and accept that phone records have never not been recorded and the data is mostly available for purchase. the company is to blame because they are complicit or negligent in the bespoke surveillance state, probably both.

xyst8• 2 years ago

welcome to a post 9/11 world. privacy has been dying for a long time. the general population doesn't care anymore. they freely give up everything to big tech anyways.

downWidOutaFite2• 2 years ago

The law that would have prevented this breach would be to make it illegal for telcos to sell customer data. The reason AT&T was feeding ALL the data to Snowflake was to sell their customer's location and social graph to marketers. It is unconscionable to me that this in not currently the law.

hanspeter4• 2 years ago

Do you have a source for that claim?

knodi123• 2 years ago

33% of all living americans? how can it be that much?

grumple• 2 years ago

There are basically 3 carriers in the US, AT&T, T-Mobile, and Verizon; other carriers use the networks of those 3.

nilamo• 2 years ago

Nothing happened to Experian, and those clowns have beaches every year. The USA has so far proved that we don't care about privacy and don't believe data is real.

ClumsyPilot4• 2 years ago

don't believe data is real.

Oh but they do, try taking some data that belongs to a corporation and see how quickly law enforcement responds. Aaron Swartz found out the hard way

It’s only when you steal personal data that nobody cares.

1vuio0pswjnm72• 2 years ago

The breach here was not against AT&T but against a cloud computing company called Snowflake.

Cloud computing companies, so-called "tech" companies, and the people who work for them, including many HN commenters, advise the public to store data "in the cloud". They encourage the public, whether companies or individuals, to store their data on someone else's computer that is connected to the open internet 24/7 instead of their own, nevermind offline storage media.

Countless times in HN threads readers are assured by commenters that storing data on someone else's computer is a good idea because "cloud" and "_____ as a service". Silicon Valley VC marketing BS.

"Maybe pierce the corporate veil and criminally prosecute those whose negligence made this possible."

Piercing the veil refers to piercing limited liability, i.e., financial liability. Piercing the veil for crimes is relatively rare. Contract or tort claims are the most common causes of action where it is permitted.

There is generally no such thing as "criminal negligence" under US law. Negligence is generally a tort.

As for fines, if there were a statute imposing them, how high would these need to be to make Amazon, Google, Microsoft or Apple employees and shareholders face "real consequences".

Is it negligent for AT&T to decide to give data to a cloud computing company such as Snowflake? HN commenters will relentlessly claim that storing data on someone else's computers that are online 24/7 as a "service", so-called cloud computing, is a sensible choice.

Data centers are an environmental hazard in a time when the environment is becoming less habitable, they are grossly diminishing supplies of clean water when it is becoming scarce, and these so-called "tech" companies are building them anyway.

Data centers are needed so the world can have more data breaches. Enjoy.

Johnny555• 2 years ago

The breach here was not against AT&T but against a cloud computing company called Snowflake.

It wasn't really a Snowflake breach, if it's like the other Snowflake data leaks, AT&T didn't set up MFA for a privileged account and someone got in with a password compromised by other means. For smaller companies I'd be willing to put more blame on Snowflake for not requiring MFA, but AT&T is large enough to have their own security team that should know what they are doing.

This is yet another wakeup call for all companies - passwords are not secure by themselves because there are so many ways for passwords to be leaked. Even though SMS MFA is weak, it's far better than a password alone.

1vuio0pswjnm72• 2 years ago

If it helps to understand the comment, change the word "breach" to "unintended redistribution of data".

The comment is about the risk created by transferring data to a third party for online storage.

It is not about the specific details of how data is obtained by unauthorised recipients from the third party.

The act of storing data with third parties who keep it online 24/7 creates risk.

Obviously, the third parties will claim there is no risk as long as ["security"] is followed

If we have a historical record that shows there will always be some deficiency in following ["security"], for whatever reasons,^1 then we can conclude that using the third parties inherently creates risk.

1. HN commenters who focus on the reasons are missing the point of the comment or trying to change the subject.

If customer X gives data to party A because A needs the data to perform what customer has contracted A to do, and then party A gives the data to party B, now customer X needs to worry about both A _and_ B following ["security"]. X should only need to trust A but now X needs to trust B, too. If the data is further transferred to third parties C and D, then there is even more risk. Only A needs the data to perform its obligation to customer X. B, C and D have no obligations to X. To be sure, X may not even know that B, C and D have X's data.

A good analogy is a non-disclosure agreement. If it allows the recipient to share the information with third parties, then the disclosing party needs to be concerned about whether the recipient has a suitable NDA with each third party and will enforce it. Maybe the disclosing party prohibits such sharing or requires that the recipient obtain permission before it can disclose to other parties.^2 If the recipient allows the information to be shared with unknown third parties, then that creates more risk.

2. Would AT&T customers have consented to their call records being shared with Snowflake. The people behind so-called "tech" companies like Snowflake know that AT&T customers have no say in the matter.

dreamcompiler• 2 years ago

Exactly. There is currently no meaningful penalty when a company fails to protect private data or violates its own privacy policies, so of course they continue to do these things because each either makes them more money or costs them less money.

Prison time being on the table for officers of the corporation is the only thing that will change this behavior.

TechDebtDevin• 2 years ago

At&t is up there with defense contractors with how intertwined their businesses are with the DoD. They're basically an extension of the intelligence agencies here in the US. They don't have consequences, much like Boeing.

highwaylights• 2 years ago

Genuinely chonky fines seems to be the answer to this problem, as it aligns incentives with rewards/penalties (if you’re lax about how your company approaches user data then you’ll be at financial risk).

Piercing the veil to prosecute those “responsible” seems like it would just incentivise the business to carry on as normal but with employees that are contractually designated (i.e. forced) to be fall guys if anything goes wrong.

hedora3• 2 years ago

If PG&E has taught us anything, utility companies can literally blow up and burn down cities and no amount of fines or paying for the damages done will matter to them.

Monopolies can always just pass the cost of the fine to their customers.

hedora3• 2 years ago

Imagine a world where suffering a data breach meant you could no longer collect, let alone hold or sell that class of data for a decade, and this rule preempted laws that required data gathering.

AT&T would be nearly equivalent to an E2E service overnight.

The lines wouldn’t be encrypted, so the NSA would still tap them, but at least there would be zero mutable storage in the AT&T data centers (except boot drives, SMS message queues, and a mapping between authorized sims and phone numbers).

In this day and age, why do they even maintain call records? They don’t need them for billing purposes, which was the original purpose of keeping them.

batch12• 2 years ago

That's quite a CPNI incident. Wonder what their fine will be. [0]

[0] https://www.tlp.law/2023/08/01/fcc-proposes-20-million-fine-....

rbetts• 2 years ago

Who is ultimately responsible, though when data is stolen in this fashion? The analyst who ETL'd this to Snowflake without MFA enabled? Or maybe the employee who inadvertently installed a data sniffer that captured usernames and passwords? Really want to send your coworkers to jail for falling for a phishing attack?

If you want corporate-death-sentence level fines, are you willing to work in environment with exceedingly strict regulatory oversight? Will you work from an office where the computing infrastructure is strictly controlled? Where you can't bring personal devices to work? Where you have no privileges to alter your work station without a formal security review?

Why not advocate for more resources to capture and try the actual criminals? Or, as elsewhere in this thread, simply make this kind of data collection illegal?

axus2• 2 years ago

If the data collection becomes illegal, what's the penalty for breaking that law? We're back to figuring out an appropriate punishment.

inetknght• 2 years ago

If you want corporate-death-sentence level fines, are you willing to work in environment with exceedingly strict regulatory oversight? Will you work from an office where the computing infrastructure is strictly controlled? Where you can't bring personal devices to work? Where you have no privileges to alter your work station without a formal security review?

If it means that privacy and safety is actually respected then yes. Working in an environment with "exceedingly strict" regulatory oversight would be a reassurance that observed violations will be dealt with in a timely fashion instead of put in the backlog and never addressed.

Why not advocate for more resources to capture and try the actual criminals?

Yes, why not? While we're at it, let's try and capture the easily-spotted criminals who perform the most trivial of attacks to servers. Just open up your SSH server logs and start going after and preventing the fecktons of log spam that hide real attacks.

Or, as elsewhere in this thread, simply make this kind of data collection illegal?

Making something illegal is great! Unfortunately it doesn't really do anything to help people after it's been stolen a second time (first time was by AT&T if it were illegal).

c22• 2 years ago

If you're going to start holding companies accountable for wasting people's time then AT&T has a lot more to answer for than this one little event.

zombiwoof• 2 years ago

User: admin Password: password

chmod7755• 2 years ago

Over in Europe this blanket saving of phone records beyond what it is necessary to operate would have been illegal in many countries, and is in general incompatible with the European Convention for the Protection of Human Rights and Fundamental Freedoms outside of active threats to national security and temporary measures overseen by a court.[1]

There's really no reason why any service providers should save this stuff in the first place, and it isn't hard to fix with legislation. Just make it illegal to even keep.

[1] https://curia.europa.eu/juris/document/document.jsf?text=&do...

Aerroon• 2 years ago

I was under the impression that the government wasn't allowed to create a mandate that a telco has to save all phone records like that, but it doesn't stop a telco from doing it themselves. I think that would fall more under GDPR limitations?

chmod7755• 2 years ago

I believe you are correct. That's what I was referring to with "illegal in many countries". Most judgements on this issue predate GDPR, but before GDPR, many countries already had similar laws and attitudes. For example article 2* and 10 of the German constitution protect personal data and communication, not just from others, but also from the government. Not unlike the GDPR.

Some service providers in Europe don't even want to save any data. The linked judgement above was the German state suing Telekom, which didn't want to save that data, and losing. Given the state of affairs, the question of "illegal or not" doesn't really come up as much. At least I'm not aware of any high profile judgements.

Besides Telekom, which always tried to minimize they data they keep to the point of fighting it all the way to Europe's highest courts, most other telcos don't really care and pick whichever middle-ground is available between "must" and "must not". Whatever is least-likely to get them into trouble. Right now that just happens to mean "save little".

* It's not stated explicitly in article 2, but the German constitutional court decided that it follows from those personal rights: https://en.wikipedia.org/wiki/Informational_self-determinati...

bobmcnamara2• 2 years ago

Historically we handled this with fiber taps at AT&T, as well as other ISPs. Some of them even knew about it.

kevin_thibedeau3• 2 years ago

What the NSA wants, the NSA gets. No legislation is needed when the system is working as intended.

ldoughty• 2 years ago

According to the article, the data was being made available to other businesses... From the detail level involved, I imagine the NSA has some sweeter deal with telcos... And they have much richer data.

arcticbull2• 2 years ago

The NSA shouldn’t need the telcos to retain these records, just hand them over to the NSA to retain right?

JumpCrisscross2• 2 years ago

What the NSA wants, the NSA gets

The NSA’s power is in being boring and unnoticed. This could be a revenue rider.

ChumpGPT2• 2 years ago

Every txt and phone call, every email and letter sent to your address along with every utility bill (list goes on) has been saved since at least 1999/2000 to present day. People like Bernie went to jail because they pushed back and it was all because of this....

Just saying.

kolbe• 2 years ago

You live in a place where the government is for the people, not for themselves.

chmod7755• 2 years ago

If it wasn't for the courts and a decent de-facto "constitution" (collection of treaties really), governments would absolutely love to expand the amount of data they (police, spy apparatus, etc.) have access to. That they also try to reduce the amount of data companies are allowed to save for themselves is tangential.

The court case I linked is evidence of that. The German state wanted Telekom to save more data, but the telco refused and won in court.

darby_nine2• 2 years ago

There's really no reason why any service providers should save this stuff

There are many reasons! Most of them are simply contrary to how folks think business should operate. Unfortunately the US seems to value "disruption" over "customer protection", so legally protecting data is unpopular on the hill.

Aurornis• 2 years ago

Over in Europe this blanket saving of phone records beyond what it is necessary to operate would have been illegal in many countries,

On the contrary, many European countries have mandatory data retention periods that meet or exceed the 6 months of records that were supposedly included in this breech.

Germany has one of the shorter retention periods at 10 weeks, but they still have to keep those records.

Saying that it would be illegal to collect these records in Europe is patently false, and furthermore the record collection is generally mandated for a period of time that depends on the country.

There's really no reason why any service providers should save this stuff in the first place,

Billing. You need phone records for billing purposes. You need to keep them for a while longer because people will dispute their bills all the time.

chmod7755• 2 years ago

Germany has one of the shorter retention periods at 10 weeks, but they still have to keep those records.

No they don't, because it's "suspended" by the federal network agency until courts are through with it. In fact they suspended it three days before the law would've come into force and thus it never was. The current state of affairs is this: the retention was ruled incompatible with German and European law in an injunction and it does not look like that is about to change.

There's a similar picture in many EU countries: There's a law on the books, but it can't be enforced/is being challenged/was already invalidated/is being rewritten/repeat.

Also note that to courts location data/phone records is a different issue than retaining information that merely associates an IP address with the subscriber that used it at some time (knowing which subscriber has what phone number is not an issue either, after all). The latter was ruled to be unproblematic by the ECJ just this year, while for the former the latest ruling is what I outlined earlier.

Besides Germany, some other countries that had data retention laws that were ruled unconstitutional are: Belgium, Bulgaria, Czech Republic, Cyprus, Romania, Slovenia, Slovakia.

In many other places that currently do have mandatory retention in force, it is being challenged.

Saying that it would be illegal to collect these records in Europe is patently false

It is illegal to mandate in such a manner. There's a difference.

Billing. You need phone records for billing purposes. You need to keep them for a while longer because people will dispute their bills all the time.

You must've not read the part where I said "beyond what is necessary to operate". Telekom for instance is doing just fine deleting phone records after 80 days - or within 7 days if you use a flat-rate and they're not relevant to billing.

nxobject• 2 years ago

I look forward to receiving my 30 cents in settlement money in five years.

exabrial• 2 years ago

The only "criminals" is AT&T for leaving the doors wide open.

TriangleEdge• 2 years ago

When are we going to see the technical report of what happened? Since this data has a specific time frame, it makes sense to me that a backup was stolen. But, we'll see.

My guess is that the tech leaders a AT&T are going to have sore wrists for a few minutes because of this.

smcin21• 2 years ago

Joining the dots on the facts so far, people don't seem to have grasped the apparent huge significance:

- guessing it was some GenAI startup looking into consumer tracking, alternate credit scoring, surveillance or other national-security use-case.

- Very unusually, the DOJ ordered two ~month-long "delay periods" in disclosure: ("The Justice Department determined on May 9 and again on June 5 that a delay in providing public disclosure was warranted"). Yet this didn't happen for Ticketmaster or MOVEit breaches revealed around the same time. "Cybersecurity delay period requests" is a new power quietly authorized by the DOJ+SEC+FBI, 18 Dec 2023 [0]. Note that [1] emphasizes this as "Corporate Alert - guidance for delay requests [on SEC 8-K]". Might Congress already have known/suspected, when it authorized the cybersecurity delay request powers, of the Snowflake/AT&T breach? Either way, whoever is involved seems to have very powerful friends. Also, the big FISA renewal vote was Apr 19 2024 [2].

- Seems the cloud instance was set up the same time GPT-4 was released (March 2023), also when Snowflake set up a Telco business unit [3] ("Location data... Alternate credit scoring, hyper-targeted marketing and more... an emerging trend of companies building partnerships with telecoms to power use cases across multiple industries"). This product is not aimed at the telcos' use-cases, but at new revenue streams. (Who might the unnamed Snowflake AI partner(s) be?)

- They set up the Snowflake instance with AT&T/MVNO customers with timestamps removed, but with location data, yet the phone numbers not obscured or removed. Doesn't sound like "internal analytics" or "competitor analysis". What sorts of end-users want to pay for the entire social-graph of 110m, regardless whether those customers never make a phone call again? [EDIT: I confused the details of this AT&T breach with the other (2019) one disclosed on 3/2024: 77m AT&T/MVNO customers, 90% of them former customers]

[0]: "FBI Guidance to Victims of Cyber Incidents on SEC Reporting Requirements: FBI Policy Notice Summary" https://www.fbi.gov/investigate/cyber/fbi-guidance-to-victim...

[1]: "US Corporate Alert - DOJ, FBI, and SEC provide guidance for delay requests relating to disclosure of cybersecurity incidents under form 8-K" https://www.klgates.com/DOJ-FBI-and-SEC-Provide-Guidance-for...

[2]: US House approves FISA renewal – warrantless surveillance and all https://news.ycombinator.com/item?id=40041784

[3]: Snowflake cloud Telco unit, 4/2023: "Unlocking the Value of Telecom Data: Why It’s Time to Act" https://www.snowflake.com/blog/telecom-data-partnerships/

iftheshoefitss4• 2 years ago

Dats cuz swifties don’t like Ticketmaster boo Ticketmaster (& hov)

jdlyga• 2 years ago

It's one more reason to use an end to end encrypted messaging app like iMessage or Telegram. Even WhatsApp is end to end encrypted. Don't use SMS/RCS.

menacingly• 2 years ago

unless I'm misunderstanding, the same data could be pulled from those services.

the message content wasn't leaked here

purpleblue• 2 years ago

WHY IS THIS DATA EVEN AVAILABLE TO BE DOWNLOADED??? Why do we not have protection in place so that hackers can't even download this data even if they wanted to?? What purpose does 2 year old data serve AT&T except to monitor us and to create social networks of people and associations?

Ylpertnodi3• 2 years ago

Er....exactly.

demondemidi3• 2 years ago

Would be great if some of the smart people here could help explain why this is such a big deal to my less tech savvy friends. I know that I don’t know how the data broker to dark web hacker pipeline works, I just know security is important. But my family is like “big deal”.

benreesman• 2 years ago

The old-timers remember a term: “dark fiber”.

There’s going to be a lot of “dark compute” once we throw these lazy assholes out.

Speaking for myself, I’m thinking of what the economics look like when HBM is abundant.

guiambros• 2 years ago

I cancelled my AT&T account over 10 years ago, yet they still stored my (old) address, full name, and SSN in the previous hack in March.

The fact we don't have decent legislation to materially punish incompetent organizations is beyond absurd.

hnpolicestate• 2 years ago

If AT&T has the power to sell said data to whichever 3rd party it wants, why should this bother me?

dbg31415• 2 years ago

Or they just sold it / gave it to NSA and needed a cover story…

iftheshoefitss4• 2 years ago

Haha on bro we tried our best but they asked nice on bro

jmount• 2 years ago

And corporations like AT&T are themselves immune to having their own identities stolen (my notes: https://win-vector.com/2024/07/12/yet-another-way-corporatio... ). Corporate EINs (the US corporation equivalent to US social security numbers) and public. Knowing one doesn't let you commit identity theft and credit card against a corporation (unlike the case for people).

berniedurfee• 2 years ago

So is this data fair game to be used by lawyers and cops in the US?

I guess maybe a cop would still need a warrant to use the data, but what about civil court cases?

itomato• 2 years ago

They have a back door to the switches. They don’t need this.

shironandonon_• 2 years ago

just put all information (names, addresses, ssn, DoB, etc) on a publicly visible blockchain already.

Then there is no data left to breach.

Instead develop systems to audit the usage of that blockchain and send to jail/military anyone who attempts to use that information in an unauthorized manner.

r3trohack3r2• 2 years ago

Reading the articles about this breach and the nature of the data in this Snowflake lake, I personally wouldn’t consider this breach a “leak” from the customer perspective - to me the leak is upstream of this breach.

Given the nature of the data in the database and the platform it was stored in, it seems extremely likely this data was not meant to be used internally by AT&T but was instead meant to be used externally by either a 3rd party partner (like advertisers and consumer analytics partners) or a government agency.

In other words, if it were my data in this datastore, I’d consider my data as already having been “leaked” when it went into the store - the issue here appears to be that this data was “leaked” to the wrong people from the perspective of AT&T and the FBI.

Liquix• 2 years ago

That's the issue with dragnet data collection and Snowflake-esque databases - it's never safe to enter any personal information on the internet. Given enough time, any and all of it will be "shared" and used for a third party's financial/political gain.

Doesn't matter if it's AT&T, a bank, or the government. Never under any circumstances can you expect anything sensitive to stay private. This used to be taught as gospel when introducing kids to the internet - it's crazy how much things have changed in 20 years.

mr_toad2• 2 years ago

Given that most businesses and government agencies now allow remote access (i.e. WFH) all personal information is on the internet already.

5g44b5nb45n• 2 years ago

I wonder how many times Snowflake has openly transmitted CP from ATT customers because they are too hungry to ingest and sell data rather than verify it.

banish-m4• 2 years ago

AT&T - too big to jail, worst UX, worst service, and worst customer service ever. Until CEOs end up in prison, nothing will change and there will be no consequences. It will never happen because money has more votes than citizens.

llm_trw7• 2 years ago

I about 6 years ago Iwas seriously wondering how snowflake could move so fast while keeping customer data secure... welllllll.

hindsightbias• 2 years ago

Does any organization, anywhere, alarm when a port exceeds a couple dozen TB of data? If they can lock down every phone use to a GB/month…

kragen7• 2 years ago

wow, a spy agency acquired the entire social network graph of the usa in one intrusion. that's bad news for civil defense; it means they have a good guess at who is the favorite relative of each legislator, governor, police chief, or general. and where they can habitually be found at each hour of the week, since this leak included location data!

how can we keep such accumulations of sensitive data from arising in the first place? only countries that figure it out are likely to survive the turbulent coming decades

EasyMark• 2 years ago

How do you know it was a spy agency? Sounded like just a hacker group. I assume 5 eyes are the only ones who have this already anyway as a matter of course. All they have to do is buy it from AT&T, no hacking necessary.

kragen7• 2 years ago

it seems unlikely that it was just for the lulz. if the intruders are auctioning off the data, do you think the russian fsb, the ministry of state security, hizbullah, mossad, or the usdoj will bid highest?

(the last, hypothetically, to destroy the data rather than use it for leverage in investigations—if not, it's in effect just another spy agency)

pyuser583• 2 years ago

Holy shit. If true …. Wow. This can be used for all sorts of evil.

crmd• 2 years ago

Airliner crashes would be as common as data breaches if regulators set the same expectations.

iftheshoefitss4• 2 years ago

Same hackers as Twilio :) no amount of security would have prevented this

cynicalsecurity• 2 years ago

In EU, this would have been a huge scandal. This would involve huge fines and the company would really try their best not to be so sloppy with data protection. But they are not in EU.

Ylpertnodi3• 2 years ago

It would be interesting if any ex-customers, living in the eu are affected - they may be covered by gdpr (though unlikely).

Tagbert• 2 years ago

So, what is the actual threat from this? That someone now has my phone number (already public) and knows that I have called or texted with some other numbers? What is the risk in that? It’s not clear.

largbae• 2 years ago

Well for one thing they can start figuring out who is not yet registered on Signal but would likely be in the phone contacts list of a rich person's number that they know. Social engineering attacks succeed with less.

aorloff• 2 years ago

I would say ATT ran afoul of a bunch of CA laws by putting this data on snowflake to begin with

robxorb2• 2 years ago

Why is it "nearly all"? Which customers didn't have their data stolen and why were they magically left aside of this? It's obvious the data theives had complete dominance in the system so what query did they run to get only "nearly all"?

xbmcuser• 2 years ago

This data will be a gold mine for scammers. When they know relationships and real names of people they can target people as well create specific attacks for different people. Now with what LLM's are capable of mass social engineering is possible.

greenavocado2• 2 years ago

Feds crucified weev in 2010 when he notified AT&T of exposed user data

theGnuMe2• 2 years ago

They even got the data of former customers, like 10 year ago customers. That should be illegal. Your personal data should be deleted after you are no longer in business together.

kator• 2 years ago

I read an article in wapo that said you can use this URL to see what data was exposed: https://www.att.com/event/lander

syngrog66• 2 years ago

hold AT&T responsible. their officers. prison time. or this kind of carelessness with millions of people's lives will keep on happening if officers get million dollar paychecks they must also risk criminal penalties to balance out

southernplaces7• 2 years ago

Events like these will only become more prevalent as more personal, corporate and other information is digitized and stored by organizations too busy with other things to 100% button down their data (possibly an impossible thing anyhow), or simply too inept (a very common thing). There is a possible good side to it though, that it makes everyone, not just a few lone souls, much more conscious about privacy and rampant personal data collection, perhaps enough for a sea change in habits in the corporate and consumer worlds.

telgareith• 2 years ago

No mention of ITAR issues? In the comments?

mikewarot• 2 years ago

Why don't organizations hide their servers behind data diodes? Store everything in an air gapped network with strictly defined interfaces.

I've been wondering this since the Office of Personnel breach[1] back in 2015.

[1] https://en.m.wikipedia.org/wiki/Office_of_Personnel_Manageme...

willfiveash• 2 years ago

In the email I got from AT&T regarding this data breach was: "Protecting customer data is a top priority. We have confirmed the affected system has been secured. We hold ourselves to high privacy standards and are always looking for ways to improve our security practices."

Well, now I feel better. 8^)

AT&T says criminals stole phone records of 'nearly all' customers in data breach

Related Stories