4 ms·

Have any corporations previously tried to deny they were breached? I'm wondering what AT&T thinks they'll achieve? If they're lying, that is.

ActionHank 3y ago
I think that they realise that they can shift the burden of proof onto the accusers and call it a day. Unless the people behind the breach actually claim responsibility and allege it was AT&T that was breached, it's near impossible for anyone to prove them wrong.
- supertrope 3y ago
  The legal and PR teams just stick their heads in the sand. For example one could say "While there was unauthorized access there is no evidence that any personal information was taken." There's zero incentive to confirm the extent of PII leaks as it just triggers more liability and regulatory scrutiny.
  - toomuchtodo 3y ago
    This seems to me like it becomes securities fraud if they're lying due to new SEC cyber disclosure regs. https://www.sec.gov/news/statement/gerding-cybersecurity-disclosure-20231214 https://www.sec.gov/news/statement/gerding-cybersecurity-dis...
    - ActionHank 3y ago
      There will be no paper trail of them even looking, it's not lying if they don't see any proof and didn't look.
      - toomuchtodo 3y ago
        Someone is always unsophisticated enough to leave an email paper trail. The necessary incantation is "litigation hold."
    - humansareok1 3y ago
      Everything is securities fraud so this is a low bar.
      - b112 3y ago
        You're a securities fraud, you are!
explorigin 3y ago
Theory: AT&T has a known relationship with the NSA. Maybe the leak was due to an NSA screw-up. In that case, they're telling a half-truth but wouldn't be allowed to tell the whole truth.
- azinman2 3y ago
  The NSA screwed up and it ended up in the hands of someone who routinely hacks into large corps? This doesn’t pass the basic smell test. I really don’t want HN to fall down the conspiracy hole that much of the internet now has. It’s eating away at our societal fabric and is wrong 99.9% of the time.
- lionkor 3y ago
  Theory: Someone at AT&T suffered a traumatic brain injury, posted all this data, forgot about it, quit, and is now living in a cottage somewhere in the mountains of Canada.
  - alephnerd 3y ago
    Fake news. A Texan can't survive the freezing winters in Banff. /s
ethbr1 3y ago
Since there's no required data custody trail (hint, hint: should be required in privacy legislation!), we'll never know. But I expect the simplest explanation is, as the article posits: 1) ATT contracts out portions of its business operations to third parties. 2. Those third parties, in the course of their business, require and have access to customer information. 3 - One of those third parties was breached. #4 ATT may or may not know. (Or may deliberately be not-asking their contractor) Presto! Security by ignorance! Given the access to SSNs, I'd assume something to do with private credit scoring.
Workaccount2 3y ago
My guess, with AT&T being an enormous and ancient corporation long past it's glory days, is that internally its a stale mess serviced by people unwilling to dive into it. The breach did happen, but things under the hood are so bad that they have no idea it happened. The layers of incompetence and don't-give-a-fuck completely obscure the evidence. The IT team, staffed mostly by young green cards who weren't even in this country 3 years ago, stare blankly at AT&T's internal auditing system developed in the 90's with a long dead and strictly proprietary language. Doesn't matter because the system didn't even catch the breach anyway. As you move up the chain, people just get more divorced from reality as they live in the delusion of AT&T still being a forefront technology company. So of course the breach didn't happen to them. At least that it my theory.
- alephnerd 3y ago
  [flagged]
  - Workaccount2 3y ago
    So you are confident that they didn't leak this data? Also, young green card in this context is synonymous with cost cutting. Young being inexperienced, green card being cheap. I apologize if you racially identify as green card.
    - alephnerd 3y ago
      [flagged]
      - Workaccount2 3y ago
        ATT is equally responsible for data leaks from companies they share data with. Our company takes in data from others and their auditing is rigorous. It's not much of a better look to be seen handing out customer data willy-nilly.
        3y ago

ActionHank 3y ago

I think that they realise that they can shift the burden of proof onto the accusers and call it a day. Unless the people behind the breach actually claim responsibility and allege it was AT&T that was breached, it's near impossible for anyone to prove them wrong.

supertrope 3y ago
The legal and PR teams just stick their heads in the sand. For example one could say "While there was unauthorized access there is no evidence that any personal information was taken." There's zero incentive to confirm the extent of PII leaks as it just triggers more liability and regulatory scrutiny.
- toomuchtodo 3y ago
  This seems to me like it becomes securities fraud if they're lying due to new SEC cyber disclosure regs. https://www.sec.gov/news/statement/gerding-cybersecurity-disclosure-20231214 https://www.sec.gov/news/statement/gerding-cybersecurity-dis...
  - ActionHank 3y ago
    There will be no paper trail of them even looking, it's not lying if they don't see any proof and didn't look.
    - toomuchtodo 3y ago
      Someone is always unsophisticated enough to leave an email paper trail. The necessary incantation is "litigation hold."
  - humansareok1 3y ago
    Everything is securities fraud so this is a low bar.
    - b112 3y ago
      You're a securities fraud, you are!

explorigin 3y ago

Theory: AT&T has a known relationship with the NSA. Maybe the leak was due to an NSA screw-up. In that case, they're telling a half-truth but wouldn't be allowed to tell the whole truth.

azinman2 3y ago
The NSA screwed up and it ended up in the hands of someone who routinely hacks into large corps? This doesn’t pass the basic smell test. I really don’t want HN to fall down the conspiracy hole that much of the internet now has. It’s eating away at our societal fabric and is wrong 99.9% of the time.
lionkor 3y ago
Theory: Someone at AT&T suffered a traumatic brain injury, posted all this data, forgot about it, quit, and is now living in a cottage somewhere in the mountains of Canada.
- alephnerd 3y ago
  Fake news. A Texan can't survive the freezing winters in Banff. /s

ethbr1 3y ago

Since there's no required data custody trail (hint, hint: should be required in privacy legislation!), we'll never know. But I expect the simplest explanation is, as the article posits: 1) ATT contracts out portions of its business operations to third parties. 2. Those third parties, in the course of their business, require and have access to customer information. 3 - One of those third parties was breached. #4 ATT may or may not know. (Or may deliberately be not-asking their contractor) Presto! Security by ignorance! Given the access to SSNs, I'd assume something to do with private credit scoring.

Workaccount2 3y ago

My guess, with AT&T being an enormous and ancient corporation long past it's glory days, is that internally its a stale mess serviced by people unwilling to dive into it. The breach did happen, but things under the hood are so bad that they have no idea it happened. The layers of incompetence and don't-give-a-fuck completely obscure the evidence. The IT team, staffed mostly by young green cards who weren't even in this country 3 years ago, stare blankly at AT&T's internal auditing system developed in the 90's with a long dead and strictly proprietary language. Doesn't matter because the system didn't even catch the breach anyway. As you move up the chain, people just get more divorced from reality as they live in the delusion of AT&T still being a forefront technology company. So of course the breach didn't happen to them. At least that it my theory.

alephnerd 3y ago
[flagged]
- Workaccount2 3y ago
  So you are confident that they didn't leak this data? Also, young green card in this context is synonymous with cost cutting. Young being inexperienced, green card being cheap. I apologize if you racially identify as green card.
  - alephnerd 3y ago
    [flagged]
    - Workaccount2 3y ago
      ATT is equally responsible for data leaks from companies they share data with. Our company takes in data from others and their auditing is rigorous. It's not much of a better look to be seen handing out customer data willy-nilly.
      - 3y ago