Cyber baddies leak 70M+ files online, claim they're from AT&T

Telco reckons data is old, isn't from its systems

More than 70 million records, allegedly stolen from AT&T in 2021, were dumped on a cybercrime forum at the weekend for miscreants to download.

The stolen records include names, Social Security Numbers, dates of birth, addresses, emails, phone numbers, and other personal information, according to Dark Web Informer, which spotted the massive data dump.

Miscreants reportedly nabbed the personal info back in 2021, and "upon review we can confirm the stolen data is legitimate," industry watchers VX-Underground said.

Back in August 2021, crime gang ShinyHunters claimed to have pilfered private details belonging to 70 million AT&T customers and attempted to sell the database for $1 million, according to digital advocacy group RestorePrivacy.

At the time, AT&T denied the stolen data came from its IT environment, telling RestorePrivacy: "Based on our investigation today, the information that appeared in an internet chat room does not appear to have come from our systems."

The latest claims of a leak emerge about a year after AT&T did admit miscreants accessed about 9 million wireless customers' account information. That breach happened in January 2023, and three months later the carrier confirm that the stolen records included so-called customer proprietary network information.

An AT&T spokesperson at the time said the data was "several years old," and "mostly relating to device upgrade eligibility."

Regarding this latest leak, AT&T told the media it has "no indications of a compromise of our systems. We determined in 2021 that the information offered on this online forum did not appear to have come from our systems.

"We believe and are working to confirm that the data set discussed yesterday is the same dataset that has been recycled several times on this forum." ®