Massive Data Breach Exposes 73 Million AT&T Users’ Information: Hacker Announces Auction with a Starting Bid of $200K, Regardless of Company Response

73 Million AT&T Users’ Data Leaked As Hacker Said, ‘I Don’t Care If They Don’t Admit. I’m Just Selling’ Auctioned At Starting Price Of $200K

AT&T Discloses Major Data Breach Exposing 73 Million Users’ Information on Dark Web

Telecommunications giant AT&T Inc. (NYSE:T) has revealed a significant data breach dating back to 2021, compromising sensitive data belonging to 73 million users, now circulating on the dark web.

The leaked data includes extensive personal details such as Social Security numbers, email addresses, phone numbers, and dates of birth, impacting both current and former account holders. AT&T acknowledges that among those affected, 7.6 million are current account holders.

“Currently, AT&T does not have evidence of unauthorized access to its systems resulting in exfiltration of the data set. The company is communicating proactively with those impacted and will be offering credit monitoring at our expense where applicable,” AT&T stated in its press release addressing the situation.

The hacker responsible for this audacious cyberattack is identified as ShiningHacker, notorious for previous breaches targeting platforms like Wattpad, Tokopedia, and Microsoft Corp.’s GitHub, as reported by Bleeping Computer.

Initially, AT&T denied internal data breach allegations when a portion of the stolen data surfaced in 2021, asserting no knowledge of leaked information from their servers or vendors. However, subsequent investigations painted a different picture. Despite AT&T’s initial denial, ShiningHacker admitted to the breach, dismissing AT&T’s stance with the assertion, “I don’t care if they don’t admit. I’m just selling,” according to Bleeping Computer.

The hacker attempted to profit from the stolen data by offering it for sale on the RaidForums data theft forum, setting the starting price at $200,000 and accepting incremental offers of $30,000. ShiningHacker expressed readiness to sell the data immediately for $1 million, underscoring the severity and audacity of the cybercrime.

This breach adds to the increasing incidents targeting telecommunications providers, with T-Mobile facing a breach in 2023 affecting 37 million customers, and Verizon Communications Inc. experiencing a leak impacting 63,000 customers and employees.

In December, the Federal Communications Commission (FCC) adopted a new role to ensure that “providers of telecommunications, interconnected voice over internet protocol (VoIP) and telecommunications relay services (TRS) adequately safeguard sensitive customer information.”

The same ruling expanded the definition of “breach” in this context, to include inadvertent access, use or disclosure of customer information, except in cases where such information is acquired in good faith by an employee or agent of a carrier or TRS provider and such information is not used improperly or further disclosed