AT&T says 7.6 million current customers were affected by a recent breach in which sensitive data was published on the dark web, along with 65.4 million former account holders. TechCrunch first reported Saturday morning that the company had reset passwords for all affected active accounts, and AT&T confirmed the move in an update posted to its support page. The data set, which AT&T says “appears to be from 2019 or earlier,” includes names, home addresses, phone numbers, dates of birth and Social Security numbers, according to TechCrunch.
TechCrunch reports that it alerted AT&T to the possibility of leaked data being used to access customer accounts on Monday, after a security researcher discovered that the logs included easily crackable encrypted passcodes. AT&T said today that it has “launched a robust investigation supported by internal and external cybersecurity experts.” The data appeared on the dark web about two weeks ago, according to AT&T.
It comes three years after a hacker known as ShinyHunters claimed in 2021 that he had obtained the account data of 73 million AT&T customers. AT&T at the time said beepcomputer that it had not suffered a breach and that the samples of information shared by the hacker online “did not appear to come from our systems.” The company now says that “it is not yet known whether the data in those fields comes from AT&T or one of its providers.” So far, it “has no evidence of unauthorized access to its systems that resulted in the exfiltration of the data set.”
AT&T says it will contact current and former account holders who were affected by the breach. The company also says it will offer credit monitoring to those customers “when appropriate.”
This article contains affiliate links; If you click on that link and make a purchase, we may earn a commission.
