Are You Affected? 86 Million AT&T Customers’ Personal Data Leaked Online

A massive trove of personal data belonging to 86 million AT&T customers—including names, contact details, and decrypted Social Security numbers—has resurfaced online, likely as part of a previously reported Snowflake cloud breach from 2024. While AT&T claims this is old, repackaged data and says affected users were already notified, the renewed circulation raises fresh concerns about ongoing risks and data security.

When signing up for products and services, we often provide companies with personal and sensitive information. This includes our names, birth dates, home addresses, Social Security numbers, and sometimes financial information. You would think and hope these companies safeguard that information, but that isn’t always true. Ask the 86 million AT&T customers whose personal data has been leaked online.

According to Hackread, they have discovered and analyzed leaked personal data purported to belong to AT&T customers. The database was initially shared on a Russian cybercrime forum back in May. However, it was later reuploaded in June, where it started circulating among other hackers and forums.

The report claims that this database contains personal information. This includes the names of AT&T customers, their dates of birth, phone numbers, email addresses, physical addresses, and about 44 million Social Security numbers (SSNs). Making matters worse, the date of birth and SSNs were initially encrypted but have since been decrypted.

This means that anyone, even without technical know-how, can read that information. It has been suggested that this information, or at least part of it, could be part of the Snowflake data breach that took place back in April 2024.

Snowflake data breach

For those unfamiliar, in April 2024, AT&T was hacked. A group calling itself ShinyHunters attacked AT&T’s servers. It breached AT&T’s Snowflake cloud environment, which gave the hackers access to the call and text metadata belonging to nearly 110 million AT&T customers.

This means that this database shouldn’t contain anything new that was found in the previous breach. AT&T has responded to the report and issued a statement that says, “It is not uncommon for cybercriminals to re-package previously disclosed data for financial gain. We just learned about claims that AT&T data is being made available for sale on dark web forums, and we are conducting a full investigation.”

The carrier also reiterated that the data was part of 2024’s breach. This means that affected customers were already notified. “After analysis by our internal teams as well as external data consultants, we are confident this is repackaged data previously released on the dark web in March 2024. Affected customers were notified at that time. We have notified law enforcement of this latest development.”