The IT Nerd

Last week, news came to light that AT&T had been pwned and literally every customer had been affected. Now there’s even worse news:

US telecom giant AT&T, which disclosed Friday that hackers had stolen the call records for tens of millions of its customers, paid a member of the hacking team more than $300,000 to delete the data and provide a video demonstrating proof of deletion.

The hacker, who is part of the notorious ShinyHunters hacking group that has stolen data from a number of victims through unsecured Snowflake cloud storage accounts, tells WIRED that AT&T paid the ransom in May. He provided the address for the cryptocurrency wallet that sent the currency to him, as well as the address that received it. WIRED confirmed, through an online blockchain tracking tool, that a payment transaction occurred on May 17 in the amount of 5.7 bitcoin. Chris Janczewski, head of global investigations for crypto-tracing firm TRM Labs, also confirmed using the company’s own tracking tool that a transaction occurred in the amount of about 5.72 bitcon (the equivalent of $373,646 at the time of the transaction), and that the money was then laundered through several cryptocurrency exchanges and wallets, but said there was no indication of who controlled the wallets.

A security researcher who asked to be identified only by his online handle, Reddington, also confirmed that a payment occurred. The hacker enlisted him to serve as the go-between for their negotiation with AT&T, and Reddington received a fee from AT&T for serving in that capacity. Reddington provided WIRED with proof of the fee payment. The hacker initially demanded $1 million from AT&T but ultimately agreed to a third of that.

WIRED viewed the video that the hacker says he provided to AT&T as proof to the telecom that he had deleted its stolen data from his computer. AT&T did not respond to WIRED’s request for comment.

I’ve been very clear that paying a ransom is something that you should never, ever do as it only encourages more of this behaviour from threat actors. This news really sucks for someone like me as I want these sorts of attacks by threat actors to end.

Pity.

If you’re a customer of AT&T, I have some really bad news for you. The telco announced that hackers have swiped data on pretty much all their customers:

We learned that AT&T customer data was illegally downloaded from our workspace on a third-party cloud platform. We started an investigation and engaged leading cybersecurity experts to help us determine the nature and scope of the issue. We have confirmed the access point has been secured.

Our investigation found that the downloaded data included phone call and text message records of nearly all of AT&T cellular customers from May 1, 2022 to October 31, 2022 as well as on January 2, 2023. These records identify other phone numbers that an AT&T wireless number interacted with during this time, including AT&T landline (home phone) customers. For a subset of the records, one or more cell site ID numbers associated with the interactions are also included.

At this time, we do not believe the data is publicly available. We continue to work with law enforcement in their efforts to arrest those involved. Based on information available to us, we understand that at least one person has been apprehended.

The thing that gets my attention is that this data was on a “third-party cloud platform”. After some hunting around I found this report from TechCrunch where it appears that AT&T has apparently become the latest victim of the Snowflake attacks that have been making the news lately. Ticketmaster for example is reportedly another victim of these Snowflake attacks.

Customers who are affect by this hack, and that to be clear is every AT&T customer, should expect this stolen data to be used to facilitate phishing and other attacks going forward. While AT&T does have a support article that details how you can protect yourself, the fact that all this data is out there is extraordinarily bad. And it will be bad for a long time to come.

UPDATE: John Gunn, CEO, Token had this to say:

This is what economists call a negative externality, the imposing of costs on a party, in this case ATT customers, as a direct effect of the actions of another party, in this case inadequate cybersecurity. The sudden rise in class action lawsuits where large groups of customers sue for huge sums of damages will likely soon be the remedy for this.

Well, this isn’t good.

AT&T has admitted to a data breach affecting 73 million current and former customers after initially denying the leaked data originated from them. That’s bad. According to the statement put out by AT&T the following number of people have been affected:

• 7.6 million current AT&T account holders
• Approximately 65.4 million former account holders

The worst part is that the data is floating around a hacker forum on the dark web.

Lovely.

AT&T has set up a new webpage reporting the incident, with tips on how customers can keep their account secure. And on top of that, the page says that the passcodes for the 7.6 million AT&T customers have been reset because they were pwned.

It really seems to me that AT&T is really doing its best to try and minimize this whole incident. Which means that this could really be worse than we know.

Stay tuned for more on this story.

Restore Privacy is breaking the news that AT&T has been pwned by hackers. Personal data from 70 million customers:

Hot on the heels of a massive data breach with T Mobile earlier this week, AT&T now appears to be in the spotlight. A well-known threat actor in the underground hacking scene is claiming to have private data from 70 million AT&T customers. The threat actor goes by the name of ShinyHunters and was also behind other previous exploits that affected Microsoft, Tokopedia, Pixlr, Mashable, Minted, and more.

And:

In the original post that we discovered on a hacker forum, the user posted a small sample of the data. We examined the sample and it appears to be authentic based on available public records. Additionally, the user who posted it has a history of major data breaches and exploits. 

While we cannot yet confirm the data is from AT&T customers, everything we examined appears to be valid. Here is the data that is available in this leak:

• Name
• Phone number
• Physical address
• Email address
• Social security number
• Date of birth

And what’s worse is that the hacker is working on decrypting data that he believes comprises user accounts’ PINs.

As for AT&T, they had this to say:

Based on our investigation today, the information that appeared in an internet chat room does not appear to have come from our systems.

There’s a problem with this statement. The claim that this was posted in an “internet chat room” is categorically false. The place where it was posted is well known for verified exploits and data dumps. Then there’s this from the guy who appears to have pwned AT&T:

It doesn’t surprise me
I think they will keep denying until I leak everything

I think AT&T may be joining T-Mobile in being in deep trouble. Let’s see how this plays out.