U.S. telecom giant AT&T recently notified customers of a data breach that allowed attackers to access information related to customers’ “equipment upgrade eligibility.
The serious security breach, which affected about 9 million customer accounts, occurred in January 2023, the same month that T-Mobile suffered a massive data breach affecting about 37 million postpaid and prepaid accounts.
An AT&T representative said in an interview that the incident compromised customer proprietary network information (CPNI), including data such as the number of lines or wireless packages on an account. In addition, personally identifiable information such as names, wireless account numbers, wireless phone numbers and email addresses were exposed. In some cases, hackers also obtained additional customer information such as monthly payment amounts, expired amounts, package names, and monthly charges and/or minutes of use.
According to an AT&T spokesperson, federal law enforcement was notified of the unauthorized access to CPNI in accordance with FCC regulations.
The good news is that no credit card information, social security numbers or account passwords were involved in the breach, and AT&T’s own systems were not compromised. AT&T also confirmed that it has fixed the breach, the first time AT&T has faced such an incident in a long time.
