Loading story…
Customer data tied to Central Tickets and AT&T surfaced on hacking forums, exposing large volumes of personally identifiable information and raising questions about how long the records had circulated before becoming public. Central Tickets data posted in September 2024 affected 723,000 unique email addresses and included names, phone numbers, IP addresses, purchase records, and passwords; the breach likely occurred months earlier. The password data was reportedly stored as unsalted SHA-1 hashes, pointing to weak credential protection.
A separate leaked dataset allegedly linked to AT&T contained tens of millions of records and was publicly posted after first being offered for sale in 2021. The exposed information included names, email and physical addresses, dates of birth, phone numbers, and U.S. Social Security numbers. AT&T initially said its systems had not been breached, then later acknowledged the dataset contained AT&T-specific fields and said it remained unclear whether the compromise originated inside AT&T or through a vendor; the company subsequently reset customer account passcodes.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
In September 2024, data from ticketing service Central Tickets was publicly posted to a hacking forum. The leak exposed 723,000 unique email addresses along with names, phone numbers, IP addresses, purchase records, and passwords stored as unsalted SHA-1 hashes.
The Central Tickets dataset publicly posted later in 2024 appears to have originated from a breach that likely happened several months earlier. The exposed data ultimately affected 723,000 unique email addresses and included names, phone numbers, IP addresses, purchase records, and unsalted SHA-1 password hashes.
Following its review of the leaked dataset, AT&T reset customer account passcodes. The move indicated concern that passcodes may have been exposed in the incident.
Twelve days after its initial denial, AT&T said the leaked dataset included AT&T-specific fields. The company stated it was still unclear whether the compromise occurred within AT&T or through a vendor.
After the March 2024 leak, AT&T said its own systems had not been compromised and suggested the exposed data came from another source. This was the company's initial public response to the incident.
In March 2024, tens of millions of records allegedly linked to AT&T were posted on a popular hacking forum after previously being sold. The leaked data included names, email addresses, physical addresses, dates of birth, phone numbers, and U.S. Social Security numbers.
A dataset later alleged to belong to AT&T was first offered for sale in August 2021. The records reportedly included sensitive customer information and predated the later public leak by several years.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A database advertised as containing data on roughly **70 million AT&T customers** resurfaced online, reviving claims first made when a threat actor offered the records for sale in 2021. Reports said the exposed information included names, dates of birth, phone numbers, physical addresses, email addresses, and in many cases **Social Security numbers**, creating significant identity-theft and fraud risk for affected individuals. AT&T said the leaked dataset did **not** come from its systems and reiterated that its internal investigation found no evidence of a direct compromise tied to the material being circulated. Independent analysis of the files, including review by breach researcher Troy Hunt, indicated the data appeared authentic for many individuals and likely originated from an older source, leaving the central dispute unresolved: the records look real, but AT&T maintains they were not exfiltrated from the company’s environment.
Jun 29, 2026
AT&T disclosed multiple major security incidents affecting tens of millions of customers. In one breach, data tied to about **51 million people** was acknowledged after customer records appeared online, prompting the company to reset account passcodes for millions of users. Reporting indicated the leaked information included personal customer details, raising concerns about account takeover and fraud exposure for current and former subscribers. AT&T later revealed a separate, far broader compromise involving call and text metadata for **nearly all AT&T cellular customers**. The exposed records reportedly covered who customers communicated with and when interactions occurred, though not the content of calls or messages. Together, the incidents underscored the scale of AT&T's data security problems, spanning both subscriber account information and highly sensitive telecommunications metadata.
Jun 29, 2026
T-Mobile disclosed a major cyberattack that exposed personal information tied to more than 40 million current, former, and prospective customers, including names, dates of birth, Social Security numbers, and driver's license details. The company said the intrusion targeted customer records and prompted an ongoing investigation, while reporting indicated the breach affected both existing subscribers and people who had previously applied for credit with the carrier. The carrier was hit again in later incidents, underscoring persistent security problems despite a reported **$150 million** investment in cybersecurity. In early 2023, T-Mobile disclosed another breach affecting customer account data, and later that year a separate exposure involving roughly **90GB** of data surfaced on a hacker forum and was linked to a T-Mobile glitch, raising fresh concerns about the company's ability to prevent repeated leaks of sensitive customer information.
Jun 29, 2026