Loading story…
AT&T disclosed multiple major security incidents affecting tens of millions of customers. In one breach, data tied to about 51 million people was acknowledged after customer records appeared online, prompting the company to reset account passcodes for millions of users. Reporting indicated the leaked information included personal customer details, raising concerns about account takeover and fraud exposure for current and former subscribers.
AT&T later revealed a separate, far broader compromise involving call and text metadata for nearly all AT&T cellular customers. The exposed records reportedly covered who customers communicated with and when interactions occurred, though not the content of calls or messages. Together, the incidents underscored the scale of AT&T's data security problems, spanning both subscriber account information and highly sensitive telecommunications metadata.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
AT&T revealed that cybercriminals stole call and text message records for nearly all of its cellular customers in a separate incident. The company said the compromised metadata covered interactions over a several-month period in 2022 and also included some records from early 2023, though message contents were not exposed.
AT&T said threat actors unlawfully accessed a workspace hosted on a third-party cloud platform between April 14 and April 25, 2024, and exfiltrated files containing customer call and text interaction records. The company learned of the threat actor's claim on April 19, activated incident response, retained external experts, and closed the access point.
AT&T publicly acknowledged that data belonging to approximately 7.6 million current customers and 65.4 million former customers had been leaked. The disclosure marked a reversal from earlier statements that there was no evidence AT&T data had been compromised.
In response to the online leak, AT&T reset account passcodes for millions of impacted customers and began notifying users whose sensitive data was exposed. The company said the newly surfaced dataset matched information that had appeared on the dark web.
A large cache of AT&T customer data was posted online, bringing renewed attention to a previously denied breach and exposing records tied to millions of current and former customers. Public reporting indicated the leaked data included sensitive personal information and account passcodes for many affected users.
AT&T later said a dataset affecting about 7.6 million current and roughly 65.4 million former account holders appears to date back to 2019 or earlier, indicating the underlying theft occurred by then. The exposed information included personal details such as names, addresses, phone numbers, dates of birth, Social Security numbers, and passcodes for many users.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
edition.cnn.com
Open sourcesec.gov
Open sourcepandasecurity.com
Open sourcetechcrunch.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A database advertised as containing data on roughly **70 million AT&T customers** resurfaced online, reviving claims first made when a threat actor offered the records for sale in 2021. Reports said the exposed information included names, dates of birth, phone numbers, physical addresses, email addresses, and in many cases **Social Security numbers**, creating significant identity-theft and fraud risk for affected individuals. AT&T said the leaked dataset did **not** come from its systems and reiterated that its internal investigation found no evidence of a direct compromise tied to the material being circulated. Independent analysis of the files, including review by breach researcher Troy Hunt, indicated the data appeared authentic for many individuals and likely originated from an older source, leaving the central dispute unresolved: the records look real, but AT&T maintains they were not exfiltrated from the company’s environment.
Jun 29, 2026
Customer data tied to **Central Tickets** and **AT&T** surfaced on hacking forums, exposing large volumes of personally identifiable information and raising questions about how long the records had circulated before becoming public. Central Tickets data posted in September 2024 affected **723,000** unique email addresses and included names, phone numbers, IP addresses, purchase records, and passwords; the breach likely occurred months earlier. The password data was reportedly stored as **unsalted `SHA-1` hashes**, pointing to weak credential protection. A separate leaked dataset allegedly linked to **AT&T** contained **tens of millions** of records and was publicly posted after first being offered for sale in 2021. The exposed information included names, email and physical addresses, dates of birth, phone numbers, and U.S. Social Security numbers. AT&T initially said its systems had not been breached, then later acknowledged the dataset contained AT&T-specific fields and said it remained unclear whether the compromise originated inside AT&T or through a vendor; the company subsequently reset customer account passcodes.
Jun 29, 2026
T-Mobile disclosed a major cyberattack that exposed personal information tied to more than 40 million current, former, and prospective customers, including names, dates of birth, Social Security numbers, and driver's license details. The company said the intrusion targeted customer records and prompted an ongoing investigation, while reporting indicated the breach affected both existing subscribers and people who had previously applied for credit with the carrier. The carrier was hit again in later incidents, underscoring persistent security problems despite a reported **$150 million** investment in cybersecurity. In early 2023, T-Mobile disclosed another breach affecting customer account data, and later that year a separate exposure involving roughly **90GB** of data surfaced on a hacker forum and was linked to a T-Mobile glitch, raising fresh concerns about the company's ability to prevent repeated leaks of sensitive customer information.
Jun 29, 2026