The Federal Communications Fee (FCC) has reached a $13 million settlement with AT&T to resolve a probe into whether or not the telecom large failed to guard buyer information after a vendor’s cloud setting was breached three years in the past.
The FCC’s investigation additionally appeared into AT&T’s provide chain integrity and whether or not the telecom large engaged in poor privateness and cybersecurity practices.
The huge information breach investigated by the FCC occurred in January 2023, when risk actors accessed buyer information of roughly 9 million AT&T wi-fi accounts saved by a vendor contracted to generate customized video content material, together with billing and advertising movies.
“Customer Proprietary Network Information from some wireless accounts was exposed, such as the number of lines on an account or wireless rate plan,” AT&T advised BleepingComputer on the time.
“The information did not contain credit card information, Social Security Number, account passwords or other sensitive personal information. We are notifying affected customers.”
The CPNI information uncovered within the January 2023 breach included buyer first names, wi-fi account numbers, cellphone numbers, and electronic mail addresses.
Though the seller was required to destroy or return the information after the contract ended—years earlier than the breach—it failed to take action. AT&T was discovered to have inadequately monitored the seller’s compliance with their contractual obligations.
“Carriers must take additional precautions given their access to sensitive information, and we will remain vigilant in ensuring that’s the case no matter which provider a customer chooses.”
AT&T agrees to spice up buyer information safety
To settle the investigation, AT&T has additionally agreed to strengthen its information governance practices to guard its customers’ delicate information in opposition to comparable vendor information breaches sooner or later.
The consent decree mandates AT&T to implement a complete Info Safety Program that features broad buyer information safety, enhance its information stock processes to trace information shared with distributors, be sure that distributors observe retention and disposal guidelines for buyer data (to restrict the quantity of buyer information susceptible up to now breaches), and conduct annual compliance audits to evaluate AT&T’s compliance with these necessities.
“The Communications Act makes clear that carriers have a duty to protect the privacy and security of consumer data, and that responsibility takes on new meaning for digital age data breaches,” mentioned FCC Chairwoman Jessica Rosenworcel.
“Carriers must take additional precautions given their access to sensitive information, and we will remain vigilant in ensuring that’s the case no matter which provider a customer chooses.”
Enforcement Bureau Chief Loyaan A. Egal additionally underscored the importance of the case, noting that “Communications service providers have an obligation to reduce the attack surface and entry points that threat actors seek to exploit in order to access sensitive customer data.”
In July 2024, AT&T warned of one other large information breach after risk actors stole the decision logs for roughly 109 million clients (practically all of its cellular clients) from a web-based database on the corporate’s Snowflake account between April 14 and April 25, 2024.
The uncovered information contained cellphone numbers, name durations, communications metadata, and variety of calls or texts. Nevertheless, AT&T mentioned the attackers could not entry the content material of the calls or texts, buyer names, or some other private data like Social Safety numbers or dates of beginning.
In April, the corporate additionally notified 51 million former and present clients of an information breach linked to an enormous quantity of AT&T buyer information leaked in March on the Breached hacking discussion board and beforehand supplied on the market for $1 million in 2021.
