Loading story…
AT&T exposed the email addresses of more than 114,000 iPad 3G customers through a web application that returned subscriber data when queried with valid ICC-ID values and an iPad-style user agent. Goatse Security used a script to enumerate identifiers and harvest addresses tied to high-profile victims, including corporate executives, media figures, government officials, and military personnel. Gawker publicized the incident after receiving sample data, while AT&T acknowledged the flaw, fixed it, apologized to customers, and said it would notify affected users; reporting at the time said the FBI opened an investigation.
The disclosure quickly escalated into a criminal case against Goatse Security members Andrew "weev" Auernheimer and Daniel Spitler, with prosecutors alleging unauthorized access under the Computer Fraud and Abuse Act and related identity-fraud charges. Auernheimer was later convicted and sentenced to 41 months in prison, though his case became a flashpoint in the security community over whether enumerating an openly accessible API constituted hacking or controversial vulnerability disclosure; later coverage noted his release after appellate proceedings without resolving the broader legal debate over security research and unauthorized access.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
A federal appeals court vacated Auernheimer's conviction, leading to his release from prison. The ruling turned on improper venue rather than resolving broader questions about whether the conduct constituted unauthorized access.
Andrew Auernheimer was sentenced to 41 months in prison, followed by three years of supervised release, for his role in the AT&T iPad case. The court also ordered restitution to AT&T, with co-defendant Daniel Spitler also held financially responsible.
A federal jury convicted Andrew Auernheimer on identity fraud and conspiracy to access a computer without authorization for his role in obtaining and disclosing AT&T iPad users' email addresses. The verdict intensified debate over vulnerability disclosure and the scope of the CFAA.
On January 18, 2011, U.S. authorities filed charges against Andrew Auernheimer and Daniel Spitler in connection with the AT&T iPad email exposure. The case alleged unauthorized access under the Computer Fraud and Abuse Act and related offenses.
Andrew 'weev' Auernheimer, identified as a Goatse Security member tied to the incident, was arrested in Arkansas during execution of an FBI search warrant. Authorities also reported drug possession charges stemming from the search, though the exact connection to the iPad case was initially unclear.
AT&T issued an apology to customers affected by the iPad 3G email-address exposure as fallout from the breach continued. The apology followed the company's acknowledgment of the flaw and remediation efforts.
Federal authorities began investigating the AT&T iPad email exposure following public disclosure of the incident. Multiple reports specifically state that the FBI was investigating Goatse Security's role in the breach.
After the exposure became public, AT&T acknowledged the security flaw, closed the vulnerable application, and said it was investigating the incident. The company later said it would notify affected customers.
Gawker/Valleywag published excerpts from the leaked list under the 'iLeak' label, bringing public attention to the exposure of more than 114,000 AT&T iPad customer email addresses. Reporting said AT&T had been notified before publication.
Goatse Security discovered that AT&T's iPad 3G web application returned customer email addresses when queried with ICC-ID or related device identifiers, and used a script to enumerate more than 114,000 addresses. The exposed data included high-profile executives, media figures, government officials, and military personnel.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
16 references tracked. Mallory keeps watching after this page renders.
theguardian.com
Open sourceforbes.com
Open sourcearstechnica.com
Open sourceweb.archive.org
Open sourcewashingtonpost.com
Open sourcenpr.org
Open sourcetheregister.co.uk
Open sourceweb.archive.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Customer data tied to **Central Tickets** and **AT&T** surfaced on hacking forums, exposing large volumes of personally identifiable information and raising questions about how long the records had circulated before becoming public. Central Tickets data posted in September 2024 affected **723,000** unique email addresses and included names, phone numbers, IP addresses, purchase records, and passwords; the breach likely occurred months earlier. The password data was reportedly stored as **unsalted `SHA-1` hashes**, pointing to weak credential protection. A separate leaked dataset allegedly linked to **AT&T** contained **tens of millions** of records and was publicly posted after first being offered for sale in 2021. The exposed information included names, email and physical addresses, dates of birth, phone numbers, and U.S. Social Security numbers. AT&T initially said its systems had not been breached, then later acknowledged the dataset contained AT&T-specific fields and said it remained unclear whether the compromise originated inside AT&T or through a vendor; the company subsequently reset customer account passcodes.
Jun 29, 2026
A database advertised as containing data on roughly **70 million AT&T customers** resurfaced online, reviving claims first made when a threat actor offered the records for sale in 2021. Reports said the exposed information included names, dates of birth, phone numbers, physical addresses, email addresses, and in many cases **Social Security numbers**, creating significant identity-theft and fraud risk for affected individuals. AT&T said the leaked dataset did **not** come from its systems and reiterated that its internal investigation found no evidence of a direct compromise tied to the material being circulated. Independent analysis of the files, including review by breach researcher Troy Hunt, indicated the data appeared authentic for many individuals and likely originated from an older source, leaving the central dispute unresolved: the records look real, but AT&T maintains they were not exfiltrated from the company’s environment.
Jun 29, 2026
AT&T disclosed multiple major security incidents affecting tens of millions of customers. In one breach, data tied to about **51 million people** was acknowledged after customer records appeared online, prompting the company to reset account passcodes for millions of users. Reporting indicated the leaked information included personal customer details, raising concerns about account takeover and fraud exposure for current and former subscribers. AT&T later revealed a separate, far broader compromise involving call and text metadata for **nearly all AT&T cellular customers**. The exposed records reportedly covered who customers communicated with and when interactions occurred, though not the content of calls or messages. Together, the incidents underscored the scale of AT&T's data security problems, spanning both subscriber account information and highly sensitive telecommunications metadata.
Jun 29, 2026