WASHINGTON, July 12 (Reuters) - AT&T ( T ) said Friday
that data from about 109 million customer accounts containing
records of calls and texts from 2022 was illegally downloaded in
April.
The U.S. telecom company said the FBI is investigating and
at least one person has been arrested after AT&T ( T ) call logs were
copied from its workspace on a third-party cloud platform.
AT&T ( T ) said the compromised data includes files containing
AT&T ( T ) records of calls and texts of nearly all of AT&T's ( T ) cellular
and AT&T's ( T ) landline customers interacting with those cellular
numbers between May 2022 and October 2022 but does not contain
the content of calls or texts or personal information such as
social security numbers.
The FBI did not immediately comment.
The compromised data also includes records from
Jan. 2, 2023, for a very small number of customers.
AT&T ( T ) said it first learned on April 19 that a hacker had
claimed to have unlawfully accessed and copied AT&T ( T ) call logs.
The company said its investigation found hackers had between
April 14 and April 25 unlawfully exfiltrated files containing
AT&T ( T ) records of customer call and text interactions. The records
also include AT&T ( T ) customers of mobile virtual network operators
using AT&T's ( T ) wireless network.
These records identify telephone numbers with which a
wireless number interacted during these periods and aggregate
call duration. A subset of records includes one or more cell
site identification number.
AT&T ( T ) said it has taken additional cybersecurity measures
including closing off the point of unlawful access.
AT&T ( T ) is working with law enforcement and said had delayed
public notification after the Justice Department determined it
was warranted. AT&T ( T ) added it does not believe that the data is
publicly available.
The company added the incident has not had a material impact
on AT&T's ( T ) operations.