AT&T fights massive data leak

For some AT&T employees, Easter was certainly anything but relaxing. After all, the well-known telecommunications company was working flat out to contain the consequences of a data leak.

AT&T changes around 73 million passwords

AT&T recently suffered a major data leak. Data from almost 73 million customers of the US telecommunications company was affected. The company has now taken action and pulled the emergency brake. As AT&T itself announced, the passwords of the affected accounts were deleted over the Easter weekend. The background to this is a data leak from 2021.

Passwords and other sensitive data of 7.6 million current and 65.4 million former customers fell victim to this. After things like social security numbers and home addresses appeared on the dark web, AT&T was forced to react. In order to prevent similar problems from occurring in the future, the company also wants to carry out meticulous root cause research.

According to the company, it has “launched a thorough investigation”. The company is relying on cooperation between “internal and external cyber security experts”. Initial findings are said to already exist. The stolen data is said to be a “data set from 2019 or earlier”. Furthermore, it has not been possible to find out how the data could have been mined.

The telecommunications service provider goes on to say that there is “no evidence of unauthorized access to its systems”. This raises the question of whether someone from the company’s own ranks may have posted the data on the dark web.

Warning against unauthorized access

According to a report by the tech blog TechCrunch, AT&T probably did not discover the actual problem of the data leak itself. Rather, a security researcher is said to have pointed out to the company that the data could also be used to gain access to the respective customer account.

This is not really surprising. After all, the company only relies on a four-digit PIN for certain functions. Fortunately, AT&T reacted quickly enough. Customers should therefore be spared serious consequences.