The Federal Communications Fee (FCC) has reached a $13 million settlement with AT&T to resolve a probe into whether or not the telecom big failed to guard buyer knowledge after a vendor’s cloud atmosphere was breached three years in the past.
The FCC’s investigation additionally examined AT&T’s provide chain integrity and whether or not the telecom big engaged in poor privateness and cybersecurity practices.
The large knowledge breach investigated by the FCC occurred in January 2023, when menace actors accessed buyer knowledge of roughly 9 million AT&T wi-fi accounts saved by a vendor contracted to generate customized video content material, together with billing and advertising movies.
“Buyer Proprietary Community Data from some wi-fi accounts was uncovered, such because the variety of traces on an account or wi-fi fee plan,” AT&T instructed BleepingComputer on the time.
“The data didn’t include bank card info, Social Safety Quantity, account passwords or different delicate private info. We’re notifying affected clients.”
The CPNI knowledge uncovered within the January 2023 breach included buyer first names, wi-fi account numbers, telephone numbers, and electronic mail addresses.
Though the seller was required to destroy or return the info after the contract ended—years earlier than the breach—it failed to take action. AT&T was discovered to have inadequately monitored the seller’s compliance with their contractual obligations.
“Carriers should take further precautions given their entry to delicate info, and we’ll stay vigilant in making certain that is the case irrespective of which supplier a buyer chooses.”
AT&T agrees to spice up buyer knowledge safety
To settle the investigation, AT&T has additionally agreed to strengthen its knowledge governance practices to guard its customers’ delicate knowledge in opposition to related vendor knowledge breaches sooner or later.
The consent decree mandates AT&T to implement a complete Data Safety Program that features broad buyer knowledge safety, enhance its knowledge stock processes to trace knowledge shared with distributors, make sure that distributors observe retention and disposal guidelines for buyer info (to restrict the quantity of buyer knowledge susceptible to this point breaches), and conduct annual compliance audits to evaluate AT&T’s compliance with these necessities.
“The Communications Act makes clear that carriers have an obligation to guard the privateness and safety of shopper knowledge, and that duty takes on new which means for digital age knowledge breaches,” mentioned FCC Chairwoman Jessica Rosenworcel.
“Carriers should take further precautions given their entry to delicate info, and we’ll stay vigilant in making certain that is the case irrespective of which supplier a buyer chooses.”
Enforcement Bureau Chief Loyaan A. Egal additionally underscored the importance of the case, noting that “Communications service suppliers have an obligation to scale back the assault floor and entry factors that menace actors search to take advantage of with a purpose to entry delicate buyer knowledge.”
“Defending our clients’ knowledge stays considered one of our high priorities. A vendor we beforehand used skilled a safety incident final 12 months that uncovered knowledge pertaining to a few of our wi-fi clients,” an AT&T spokesperson instructed BleepingComputer after publishing time.
“Although our techniques weren’t compromised on this incident, we’re making enhancements to how we handle buyer info internally, in addition to implementing new necessities on our distributors’ knowledge administration practices.
“In step with FCC necessities, we started notifying clients of this incident in March 2023.The info included info just like the variety of traces on an account. It didn’t include bank card info, Social Safety Numbers, account passwords or different delicate private info.”
In July 2024, AT&T warned of one other large knowledge breach after menace actors stole the decision logs for roughly 109 million clients (practically all of its cellular clients) from a web based database on the corporate’s Snowflake account between April 14 and April 25, 2024.
The uncovered knowledge contained telephone numbers, name durations, communications metadata, and variety of calls or texts. Nevertheless, AT&T mentioned the attackers could not entry the content material of the calls or texts, buyer names, or another private info like Social Safety numbers or dates of beginning.
In April, the corporate additionally notified 51 million former and present clients of an information breach linked to a large quantity of AT&T buyer knowledge leaked in March on the Breached hacking discussion board and beforehand supplied on the market for $1 million in 2021.
Replace September 17, 14:54 EDT: Added AT&T assertion.