AT&T has initiated the process of notifying state authorities and regulators across the U.S. about a significant security incident, following the confirmation that millions of its customers’ records, recently found online, are genuine. The company, recognized as the largest telecommunications provider in the U.S., has disclosed in a legal filing with Maine’s attorney general that the breach compromised the personal information of over 51 million people, including details as sensitive as Social Security numbers.

In the aftermath of the breach, AT&T has initiated measures aimed at addressing the immediate concerns of affected individuals, including the offering of credit monitoring services to help guard against identity theft.

Why it matters: This breach not only shows the vast scale of data vulnerability among leading telco providers but also highlights the potential risks millions of individuals face regarding identity theft and fraud. The compromised data dates back to mid-2019 and includes critical personal information, pointing to long-term privacy concerns for affected customers. AT&T’s delayed action in addressing the data’s authenticity raises questions about the adequacy of corporate data protection strategies and the importance of rapid response mechanisms in safeguarding customer privacy.

• Customer Impact: More than 51 million individuals have been notified about the breach, with personal information such as names, addresses, birth dates, phone numbers, and Social Security numbers being compromised. This includes current customers and approximately 65 million former customers.

• Delayed Response: The data, initially leaked in parts, became fully public last month, allowing for verification. AT&T’s acknowledgment and subsequent actions, including resetting account passcodes, came years after the first signs of the breach, highlighting a significant delay in response.

• Source of the Leak Unknown: Despite the widespread impact of this breach, AT&T has yet to identify the origin of the leak, leaving unanswered questions about the security of customer data and the measures needed to prevent future incidents.

Go Deeper -> AT&T notifies regulators after customer data breach – TechCrunch