01—Abstract
Summary
Summary of the 8-K filed July 12, 2024. Cited figures are marked; the original filing is the authoritative source.
AT&T Inc. has filed an 8-K detailing a cybersecurity incident where a threat actor claimed to have accessed AT&T call logs.
The unauthorized access occurred on a third-party cloud platform between April 14 and April 25, 2024, resulting in the exfiltration of files containing records of customer call and text interactions from specific past periods (May 1 to October 31, 2022, and January 2, 2023). Importantly, the compromised data does not include the content of calls or texts, nor sensitive personal information like Social Security numbers or dates of birth.
While the data does contain telephone numbers of AT&T wireless customers, MVNO customers using AT&T's network, AT&T wireline customers, and customers of other carriers, along with interaction counts and aggregate call durations, AT&T states it does not believe this incident is reasonably likely to materially impact its financial condition or results of operations as of the filing date. The company has implemented additional cybersecurity measures, is cooperating with law enforcement (which has led to at least one apprehension), and will notify impacted customers.
02—Key points
Key Highlights
- Cybersecurity incident involving alleged exfiltration of AT&T customer call and text interaction records.
- Data accessed was from specific historical periods: May 1-Oct 31, 2022, and Jan 2, 2023.
- Compromised data does NOT contain call/text content, SSNs, dates of birth, or other PII.
- Affected data includes phone numbers interacting, interaction counts, and aggregate call durations.
- AT&T does not believe the incident will materially impact its financial condition or results.
- The company is working with law enforcement, and at least one individual has been apprehended.
- AT&T will provide notice to all impacted current and former customers.
03—Questions
Frequently Asked Questions
What specific customer data was compromised in the AT&T cybersecurity incident?
The compromised data includes records of customer call and text interactions for specific historical periods (May 1-Oct 31, 2022, and Jan 2, 2023). This data contains telephone numbers of interacting parties, counts of interactions, and aggregate call durations. It may also include cell site identification numbers for a subset of records. Crucially, the content of calls or texts, Social Security numbers, dates of birth, or other personally identifiable information were not accessed.
Does AT&T believe this incident will have a material financial impact?
As of the filing date (July 11, 2024), AT&T states that it does not believe this incident is reasonably likely to materially impact its financial condition or results of operations.
What actions has AT&T taken in response to the incident?
AT&T has activated its incident response process, retained external cybersecurity experts, closed off the point of unlawful access, and is cooperating with law enforcement. At least one individual has reportedly been apprehended. The company will also notify all impacted customers.
When did the unauthorized access occur and when was it disclosed?
The unauthorized access to the third-party cloud platform occurred between April 14 and April 25, 2024. AT&T learned of the incident on April 19, 2024. Public disclosure was delayed with the U.S. Department of Justice's approval, and the 8-K filing was made on July 11, 2024.
04—Continue