21 ms·

AT&T says criminals stole phone records of 'nearly all' customers in data breach

• deleted 2y ago
  [deleted]
• smcin 2y ago
  This is huge; also AT&T knew on Apr 19 but only disclosed now; ongoing fallout from the Snowflake compromise: - Records downloaded from Snowflake cloud platform - "AT&T will notify 110 million AT&T customers" - Compromised data includes customer phone numbers ("for 77m customers"), metadata (but not actual content or timestamp of calls and messages), and location-related data. Not SSNs or DOBs. Mostly during a six-month period 5/1-10/31/2022, but more recent records from 1/2/2023 for a smaller but unspecified number of customers. TechCrunch [1] has more details including Mandiant's response, the name and suspects location of the cybercriminal group [1]: https://techcrunch.com/2024/07/12/att-phone-records-stolen-data-breach/ https://techcrunch.com/2024/07/12/att-phone-records-stolen-d... I wonder if Congress manages to summon TikTok-like levels of anger on regulating this one.
• John23832 2y ago
  And, honestly, how is this info (which I WOULD want to know) meaningfully actionable to customers. We get our information stolen from a myriad of sources everyday. These companies do comparatively nothing to make things right and the burden falls on customers to pick up the pieces if you're in a tranch that is sold and used.
  • smcin 2y ago
    Of course it's not meaningfully actionable to customers, big time lag in not disclosing since Apr 19. (Why does this not fall under SOX violation with the obligation to report timely to affected parties? It has affected AT&T's stock price -3% in early trading, so should it have also required SEC disclosure?) Wondering what is the significance that most of the stolen records were from the period 5/1-10/31/2022? Does it mean that AT&T enabled 2FA on more recent records, or that more recent records were on a different cloud bucket (or that they mostly stopped using Snowflake since)?
    • Sylamore 2y ago
      Because AT&T reported it to the FBI and DOJ, they in turn requested AT&T to not disclose it and there are exceptions in the SEC rules for exactly that scenario of actively working with law enforcement. Regarding 2FA, it probably means they just enabled it in their access rules for any access to snowflake, but it's highly unlikely AT&T will walk away from Snowflake anytime soon because it had become their preferred BI/Data Analytics platform and they were actively migrating several hundred TBs of data out of Hadoop to Snowflake.
• deleted 2y ago
  [deleted]
• lumb63 2y ago
  This is another consequence of the surveillance state. The same data that can be used to surveil us by the government can be stolen by who-knows-who. We’d all (mostly) be far better off, IMO, if companies didn’t retain such records.
  • Jgrubb 2y ago
    Yes but have you ever asked a dev if they actually need the 8 year old logs in some bucket?
  • rustcleaner 2y ago
    My wet dream would be a dump of all SMS or Meta or iMessage messages for a multiyear period for nearly 90% of users. Only when Normie Norman's private chats to his mistress and other little relationship trust disrupting secrets become uncensorably hosted on the darknet and freely searchable, only then will Normie Norman get a clue and install SimpleX/Briar/Cwtch/any other owner-free decentralized p2p chat.
    • dtx1 2y ago
      While I share the sentiment, Normie Norman is not at fault. Meta and other BigCorps are the perpetrators and Norman the Victim.
      • rustcleaner 2y ago
        True, but you have to admit once you really see Normie Norman you come to understand aristocracy. At least I do anyway.
        • shrimp_emoji 2y ago
          https://dwm.suckless.org/ https://dwm.suckless.org/ > Because dwm is customized through editing its source code, it's pointless to make binary packages of it. This keeps its userbase small and elitist.
• buro9 2y ago
  Including all location metadata associated to that?
  • smcin 2y ago
    The reports said celltower-level location data associated with calls and texts (but not datestamps). That would allow inferring their homes, job location, commute, family members, social graph.
    • sitkack 2y ago
      You can still recover that without timestamps. It also looks like if anyone interacted with an ATT customer or used an MVNO your data is in there too.
      • dylan604 2y ago
        It even said land lines had their numbers in the data if an ATT customer contacted one. Edit: I must have read that from a different article than the TFA though.
        • sitkack 2y ago
          Yeah, all att customers, 2nd party participants and any other user of their network. Not just direct customers.
• akshayB 2y ago
  The real problem is that data needs to be deleted over time. There is not much of a use case for customers for go back last year and see who called them and obviously there are use cases like criminal investigations or spying. But customer has no power or ability to dictate how long their records are store and how they are used. Companies should provide tools and features to their customers empowering them with their data.
  • tantalor 2y ago
    This isn't data for serving user needs, this is data for spying on users
  • mountainb 2y ago
    Non-murder criminal offenses typically have very short statutes of limitations. A lot of this could also be solved by encouraging the federal government to enforce federal privacy law as written more aggressively. A good incentive would be to amend the privacy statutes to permit the FTC to keep the funds extracted from settlements and penalties in-house. This would allow them to increase staffing and create a positive feedback loop to deter wrongdoing. This would have a negative effect on incumbent companies and practices, but it would not take long for the message to get across and for practices to change accordingly. Congress tends to prefer keeping agencies on its own budgetary string which paradoxically limits what the agencies are capable of doing. The laws that we think protect us do not protect us because many of them are within the exclusive jurisdiction of a federal agency with very limited powers and funds. In the US the leadership likes to create the illusion that it has made "Bad Problem" illegal by writing it into the law, but it does not like creating the conditions in which "Bad Problem" could be solved, whether it's because the tradeoffs involved are tough to contemplate or because keeping "Bad Problem" around as a visible enemy is clever politics.
    • _heimdall 2y ago
      > Non-murder criminal offenses typically have very short statutes of limitations. There's a hidden assumption here. The expectation is that data retention and potential privacy violations are a necessary evil because anyone may later be under investigation for a crime. The data could go uncollected, it isn't AT&Ts job to retain private information on all of us just in case an investigator wants it. Take telecoms out of it and consider a convenience store. Police would like to have video recordings of whatever moment in time they are investigating, but that doesn't mean the video has to be recorded and retained. A shop owner can choose to record videos and only retain them for a week if they want, or they can have cameras installed but not even recording if they're okay with just the effect of deterrence.
• smcin 2y ago
  Ongoing fallout from the Snowflake compromise; AT&T knew on Apr 19 but only disclosed now (Why does this not fall under SOX violation with the obligation to report timely to affected parties? It has affected AT&T's stock price -3% in early trading, so shouldn't it have also required SEC disclosure?) - Records downloaded from Snowflake cloud platform - AT&T will notify 110 million AT&T customers - Compromised data includes customer phone numbers, metadata (but not actual content or timestamp of calls and messages), and location-related data. Not SSNs or DOBs. Mostly during a six-month period 5/1-10/31/2022, but more recent records from 1/2/2023 for a smaller but unspecified number of customers. TechCrunch report has more details including Mandiant's response, the name and suspects location of the cybercriminal group I wonder if Congress manages to summon TikTok-like levels of anger on regulating this one.
  • softwaredoug 2y ago
    > Snowflake blamed the data thefts on its customers for not using multi-factor authentication to secure their Snowflake accounts, a security feature that the cloud data giant did not enforce or require its customers to use. So AT&T put all our call information somewhere and hid it probably behind a weak password with no additional factors. IMO that's actionable negligence and I hope they get sued to oblivion.
    • smcin 2y ago
      I'm more stunned that AT&T knew back on Apr 19 [UPDATE: Mar 20] yet feels it had neither an SOX violation or SEC obligation (share price effect) to notify timely. Like, by Apr 22. Not three months later [UPDATE: 4 months later]. Remember the massive Yahoo 2014 hack which Yahoo management failed to notify its own users for 2 years? If SOX violation only literally covers users' own passwords getting breached, but not 2FA or other passwords to access the same data, will Congress amend it urgently? EDIT: apparently they're hiding behind the 3/20 disclosure [0] which is all they disclosed until [1],[2] today. [0]: March 30, 2024 - "AT&T Addresses Recent Data Set Released on the Dark Web" https://about.att.com/story/2024/addressing-data-set-released-on-dark-web.html https://about.att.com/story/2024/addressing-data-set-release... > "AT&T has determined that AT&T data-specific fields were contained in a data set released on the dark web; source is still being assessed... > "AT&T has launched a robust investigation supported by internal and external cybersecurity experts. Based on our preliminary analysis, the data set appears to be from 2019 or earlier [incorrect], impacting... approx 7.6m current and 65.4m former AT&T account holders"* > "Currently, AT&T does not have evidence of unauthorized access to its systems resulting in exfiltration of the data set.... As of today, this incident has not had a material impact on AT&T’s operations."* [but did it have a material impact on the customers/ex-customers?!] [1]: Jul 12, 2024 - "AT&T Addresses Recent Incidents Regarding Access to Data" https://about.att.com/pages/data-incident.html https://about.att.com/pages/data-incident.html [2]: Jul 12, 2024 - "AT&T Addresses Illegal Download of Customer Data" https://about.att.com/story/2024/addressing-illegal-download.html https://about.att.com/story/2024/addressing-illegal-download... > "Based on our investigation, the compromised data includes files containing AT&T records of calls and texts of nearly all of customers of [AT&T’s cellular and (MVNOs) using AT&T’s wireless network], as well as AT&T’s landline customers who interacted with those cellular numbers between May 1, 2022 - October 31, 2022. The compromised data also includes records from January 2, 2023, for a very small number of customers. The records identify the telephone numbers an AT&T or MVNO cellular number interacted with during these periods. For a subset of records, one or more cell site identification number(s) associated with the interactions are also included."
• John23832 2y ago
  How has Snowflake felt ANY recourse for being the source of all of these hacks?
  • beardedwizard 2y ago
    The dark web and info stealing malware are the source of the hacks. My worry is not only that consumers get numb to breaches, but they consume rampant misinformation and have no idea how to hold appropriate parties accountable. How many times have you held AWS accountable for stolen access keys? Was it AWS fault when rabbit leaked their own keys? Is it snowflakes fault when you lose your creds to infostealing malware? How should snowflake enforce mfa on machine service account credentials? The answers are no, no, and they can not possibly. Not even hyperscalers have this magic.
    • edm0nd 2y ago
      Eh, iirc the source of the hack was just regular stealers like Redline, not "the dark web". It was actually Snowflakes fault. The threat actors were able to find a test/demo account they could log into and from there they were able to access prod things they shouldnt have.
      • beardedwizard 2y ago
        This is exactly the kind of comment I'm talking about. You have not read anything from snowflake, mandiant or crowdstrike on this, and you haven't even read the cnn article that has snowflakes response on this. The snowflake demo account has nothing to do with it.
        • edm0nd 2y ago
          No, its what happened 100%. Funnily enough, its YOU who hasnt read anything. https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion https://cloud.google.com/blog/topics/threat-intelligence/unc... "In April 2024, Mandiant received threat intelligence on database records that were subsequently determined to have originated from a victim’s Snowflake instance. Mandiant notified the victim, who then engaged Mandiant to investigate suspected data theft involving their Snowflake instance. During this investigation, Mandiant determined that the organization’s Snowflake instance had been compromised by a threat actor using credentials previously stolen via infostealer malware. The threat actor used these stolen credentials to access the customer’s Snowflake instance and ultimately exfiltrate valuable data. At the time of the compromise, the account did not have multi-factor authentication (MFA) enabled." https://www.symmetry-systems.com/blog/what-we-know-so-far-about-the-snowflake-breach/ https://www.symmetry-systems.com/blog/what-we-know-so-far-ab... "Snowflake has confirmed that a threat actor obtained credentials of a single former employee and accessed demo accounts they had access to. Snowflake asserts these accounts contained no “sensitive” data and were isolated from production and corporate systems. However, unlike Snowflake’s core systems, which are protected by Okta and Multi-Factor Authentication (MFA), these dormant demo accounts lacked such safeguards. "
• softwaredoug 2y ago
  > AT&T blamed an “illegal download” on a third-party cloud platform WTF does this even mean? The cloud employees downloaded it? If its so sensitive, why wouldn't this be heavily e2e encrypted?
  • JohnMakin 2y ago
    This is related to the snowflake breach. Snowflake is blaming customers for not enabling MFA.
    • tpurves 2y ago
      Looks like more than enough blame to go around. Not enabling MFA is pretty egregious by ATT. Snowflake creating a platform where such a high consequence mistake is apparently easy to make, and obviously without sufficient compensating controls to detect or limit impact of such a single point of failure. That's egregious too.
• rybosworld 2y ago
  Consumers are so numb to data breaches that these events now bring very little outrage. I think without that anger from the consumer, there's little incentive for companies to do more to stop data breaches from happening.
  • chefandy 2y ago
    Well it's starting to feel like data privacy just doesn't exist anymore. I don't know why administrators for big customer databases even bother setting passwords these days.
    • pavel_lishin 2y ago
      My mother was concerned that some of her information, and mine, leaked because she signed up for another bank account from a place she decided she didn't trust. She said she wasn't worried about the money being stolen, but she was worried about our identities being stolen. My concern was the complete opposite - I assume that my social security number and address are already for sale for a fraction of a cent somewhere, bundled with 10,000 other identities. But if money gets stolen, that's a whole rigamarole, with banks wringing their hands and saying "identity theft" as if that clears them from any responsibility.
      • 0cf8612b2e1e 2y ago
        As a nobody, I keep wanting a financial product that is a black hole. Money can go in, but cannot come out without significant pain. Seven+ day waiting period, in person visit, physical mail verification, something, anything that means if I do get hacked my accounts are not drained in milliseconds. When I need a legitimate large withdrawal, I can go through the required effort.
        • chefandy 2y ago
          You can have a financial manager control your accounts for you and just keep a small checking account, (plus they'll help you grow your balances) but they're not free. Well, they're not free if you want them to be unbiased. Given, what's going to keep them from getting scammed? Maybe what you're looking for is several safe deposit boxes.
• deleted 2y ago
  [deleted]
• hughesjj 2y ago
  And this is yet another reason why I use signal
  • jacobwilliamroy 2y ago
    Do you exclusively use signal? Do your friends also use signal? Do you have friends who only use signal to communucate with you?
    • llm_trw 2y ago
      Yes.
      • ghaff 2y ago
        Aside from a couple non-US friends, I know no one in the US who uses anything other than straight SMS (and Apple iMessage). I'm sure they exist but certainly not in the circle of people I communicate with.
        • BenjiWiebe 2y ago
          There's definitely different circles in the US. My circle of friends and family is on Whatsapp. More than 99% of my communications would be through WhatsApp.
        • lotsofpulp 2y ago
          Everyone I know in the US uses either iMessage or Whatsapp. No one I know uses MMS.
        • ectospheno 2y ago
          Everyone I know uses signal. Different people really are different.
          • ghaff 2y ago
            For whatever reason, chat seems to definitely encourage tribalism. The last company I worked for eventually bought into Slack because so many people WOULD NOT use anything else while a lot of us were like "ANOTHER chat app??" because we were perfectly happy with Gchat which we had as part of Google Workplace. I know there are some historical reasons for non-SMS because of text pricing outside the US but everyone I know in the US would look at you funny if you wanted to use some special app for texting.
• jen20 2y ago
  This is the kind of breach that really should be company-ending, but will sadly instead likely result in a slap on the wrist. It is high time for the US to have a privacy law with real teeth, and to enforce it with vigour.
  • Ekaros 2y ago
    Class-action suit sounds reasonable, but sadly those never give penalties in right ballpark. Here it should be hundreds to thousands at least per affected customer. But my guess it is few tens of cents, if that... While lawyer will get nice couple million pop...
  • criddell 2y ago
    Or maybe it's time to turn software engineering into an actual engineering profession. If the people responsible for designing and maintaining the AT&T system were "real" engineers, they could be sued for malpractice or even lose their license to practice.
    • ghaff 2y ago
      Do you really think that requiring 4-year degrees and passing a licensing exam would make a big difference? The fact is that, outside of civil engineering which involves a lot of dealing with regulatory agencies, most engineers in the US don't have PEs. I started on the path to get one because, had I stayed on my initial career path, I'd have been sending blueprints etc. to regulatory agencies but I ended up changing careers.
      • acuozzo 2y ago
        No, what will make the difference is being personally liable for the vulnerabilities you introduce. Not the company. You.
        • ghaff 2y ago
          How many individual engineers do you suppose get prosecuted for making errors--even careless ones? I'm guessing very few in the West. And I'm not even sure lopping off a head here and there to encourage the others is even a good idea.
• JohnMakin 2y ago
  So where/what is my compensation? (I know there is no recourse). When no one is on the hook for secure practices, like enabling MFA on your effin data stores that contain massive amounts of customer PII, this is the result. Not even an apology, just report it and move on. woops! those gosh darned cyber criminals.
  • criddell 2y ago
    If you go to court and ask for compensation you would likely be asked to show harm. Could you?
    • JohnMakin 2y ago
      It really doesn’t matter. Compensation has been dispensed to customers in data breaches such as credit/ssn info, no harm proof needed. Potential for harm is enough. Breach of contract, as a customer do I have a reasonable expectation that this data is not exposed? of course I do. No one could very seriously argue it’s a zero sum.
    • EarthLaunch 2y ago
      Is there no harm, or is there harm that is hard to show in court?
      • lesuorac 2y ago
        A bit of both. Most people aren't going to have their identity stolen (or insert w/e crime). Those that do will have trouble proving it was from this leak.
  • latchkey 2y ago
    I've received checks over the years for various things like this. You end up having to fill out a claim form and then wait about 5 years and one day, you get this check in the mail for some tiny amount of money.
• jenny2244 2y ago
  [dead]
• floatrock 2y ago
  > In a statement, AT&T said that the stolen data contains phone numbers of both cellular and landline customers, as well as AT&T records of calls and text messages — such as who contacted who by phone or text — during a six-month period between May 1, 2022 and October 31, 2022. AT&T customer? Prepare for phone calls / text messages from your most frequent contacts saying "I got stranded / I'm Officer Blahblahman helping your friend get home... please send gift card / venmo" It's only metadata...
  • morkalork 2y ago
    I guess everyone is going to learn what Snowden was worried about the hard way now. I imagine there's going to be extortion attempts over calls to abortion clinics etc.
    • smcin 2y ago
      Among other things. The data's mostly from May-Oct 2022.
  • rustcleaner 2y ago
    I just realized this is going to fvck my call blocking strategy up: now creditors will have a bank of known good numbers to spoof into my whitelist with! :^O
  • deleted 2y ago
    [deleted]
• josefritzishere 2y ago
  damn
• ungreased0675 2y ago
  So, AT&T wasn’t using MFA? A lot of information can be derived from analysis of call records. If this information becomes public, it could be disastrous.
  • ffsm8 2y ago
    > If this information becomes public, it could be disastrous. Isn't it even worse if it doesn't become public? It's been downloaded by an unauthorized party after all, so if they're not publishing the data, I'd wager they've found another way to profit from it. I.e. blackmail or similar. I guess it depends on your viewpoint wherever that's better or worse.
• xyzzy4747 2y ago
  It's interesting when you have these old, large, sprawling bureaucratic organizations and the employees hardly give a sh!t anymore and allow for these large vulnerabilities. It's not a money issue, it's a caring issue I think.
  • hypeatei 2y ago
    Our economic system is at odds with security because we're trying to "get by" as cheap as possible. That doesn't bode well for protection of users' data.
    • lotsofpulp 2y ago
      During the last decade, ATT’s leaders decided to burn tens of billions of dollars by overpaying for obviated businesses like DirecTV and Time Warner. I can only imagine the quality of mobile and fiber networking we could have had if that money was spent on telecommunications. And maybe they would have spent a few million on having proper security.
      • dopylitty 2y ago
        Not only that they blew $8 billion/year on dividends that could've gone into the business or to employees instead of being extracted and given to people who have nothing to do with the business.
        • lotsofpulp 2y ago
          When people invest in a business, whether it be your sibling’s business, or a local business, or a publicly traded business, they do it because they expect a return on investment. An infrastructure utility such as ATT typically has to offer dividends because it is not going to experience the type of growth that would result in a return via share price increase. Of course, ATT’s prices are not regulated like a proper utility, even though they should be, but it is still subject to the same market forces that prevent it from growing like a tech company would, who would have the option of foregoing dividends (or share buybacks).
• deleted 2y ago
  [deleted]
• swarnie 2y ago
  Why would AT&T even need to keep this data? All i can think of is billing for a fraction of plans from the early 2000s who still pay per min/per text. Or maybe for capacity metrics but even then you only need the overall data point not the actual records once collaborated. What's the US law for keeping data as long as its relevant and needed?
• ilteris 2y ago
  I am an ATT user and on a pixel which generally good at filtering spam messages. I have noticed I was getting so much spam messages recently ("wanna make money working remotely for x hours a day only") I was surprised and thought my number somehow made it to one of those spam networks. This confirms my suspicions.
• bobo_legos 2y ago
  Snowflake might want to take this page down in light of today's news. https://www.snowflake.com/en/customers/all-customers/case-study/att/ https://www.snowflake.com/en/customers/all-customers/case-st...
• deleted 2y ago
  [deleted]
• cddotdotslash 2y ago
  Another article[1] cites AT&T's Snowflake deployment as the source of the breach: > It’s not clear for what reason AT&T was storing customer data in Snowflake, and the spokesperson would not say. [1] https://techcrunch.com/2024/07/12/att-phone-records-stolen-data-breach/ https://techcrunch.com/2024/07/12/att-phone-records-stolen-d...
• smcin 2y ago
  AT&T stock has already bounced back from much of the initial -2.6% drop this morning, so the market thinks AT&T is immune. Meanwhile Snowflake is -3.9% down (they have many other customers than AT&T). https://www.marketwatch.com/investing/stock/T https://www.marketwatch.com/investing/stock/T https://www.marketwatch.com/investing/stock/SNOW https://www.marketwatch.com/investing/stock/SNOW
  • jader201 2y ago
    I never got the impression that the market ever cares about data breaches. It seems most companies are rarely held financially responsible for data breaches anyway. I would bet any effects you’re seeing in stocks is unrelated to this news.
    • smcin 2y ago
      They are very much related to the news, that's precisely why I linked to the stock charts: AT&T was flat overnight but opened (9am ET) with a -2.6% spike down, but has been recovering since. Their press release appears to have been Friday 7am ET shortly before market open [https://about.att.com/story/2024/addressing-illegal-download.html https://about.att.com/story/2024/addressing-illegal-download...]. Also as corroboration here's MarketWatch: "AT&T’s stock slides 3% after company discloses hack of calls and texts" [https://www.marketwatch.com/story/at-ts-stock-slides-2-9-after-company-discloses-hack-of-calls-and-texts-908a5fa1 https://www.marketwatch.com/story/at-ts-stock-slides-2-9-aft...]
      • soulofmischief 2y ago
        I'm not saying there's no way the stock pullback wasn't caused by the hack, but it's also important to note that MarketWatch article only establishes correlation, not causation.
        • seadan83 2y ago
          Most linked financial news is auto-generated and auto-correlated. Lots of "why did.." when nobody knows, and frankly there often is no why. Perhaps that was the day a retirement fund shifted money, who knows. While this price movement is very well correlated, perhaps causal even, but marketwatch (and all similar bottom feeders that are just trying to make ad revenue), it's a case of a broken clock being right. Those financial news sites which link recent news to stocks, eg Yahoo, benzings, - those recent news headlines are just the same as ad tech now. It is noise.
• deleted 2y ago
  [deleted]
• pylua 2y ago
  And earlier this year my ssn was on the dark web due to their leak (or vendor). One year of monitoring? No, I’m going to need it for life. Security is not a concern. There is no real incentive to change the status quo. Make them pay for monitoring indefinitely .
  • ajsnigrutin 2y ago
    I never understood the american secrecy about SSN... it should be a "username" not a "password"... In my country you can calculate our own national id (mix of date of birth, autoincreasing number by each birth that day + 1 checksum number), and if you do/have any kind of personal business, your personal tax number has to be written everywhere, on every receipt you hand out or anything you buy as a business. Somehow knowing that first boy born today will have an ID number of 120702450001X (too lazy to calculate the checksum, but the algorithm is public), doesn't help anyone with anyting bad.
    • ThunderSizzle 2y ago
      SSN is too public for it to be private or secret. Multiple employers, schools, medical institutions, financial institutions all ask for it, so it's not private. It's also treated as evidence of who you are, but it isn't tied to identification like an ID is. These institutions use it without ever truly validating it. It's similar to how records fraud can occur - people can record anything to the local registrar office, including fraudulent documents, without any checks. Once it's registered, it becomes evidence against the real owner. It's really messed up.
    • strangecharm2 2y ago
      This comment pops up every time someone talks about social security numbers. Yes, they were never supposed to be private, but now they are. So either Congress can do something about it, or big companies can stop leaking them. Clever "well, actually"s didn't stop my identity from being stolen recently after a breach, and they never will.
      • dboreham 2y ago
• cwillu 2y ago
  “Brad Jones, chief information security officer at Snowflake, told CNN in a separate statement that the company has not found evidence this activity was “caused by a vulnerability, misconfiguration or breach of Snowflake’s platform.” Jones said this has been verified by investigations by third-party cybersecurity experts at Mandiant and CrowdStroke. AT&T said it launched an investigation, hired cybersecurity experts and took steps to close the “illegal access point.”” That's pretty rich: “it wasn't misconfigured, it was just illegally open, and now we're closing it”.
• zomg 2y ago
  when will governments hold these companies, but more importantly their executives, criminally liable for their lack of protecting customers' information?
  • hulitu 2y ago
    When they will not buy data from them. /s
• mdale 2y ago
  Interesting that they use the word criminals instead of hackers.. makes it sound like it was a physical heist rather than poor security practices on their part :)
  • demondemidi 2y ago
    They are criminals.
• asimpleusecase 2y ago
  [flagged]
  • deleted 2y ago
    [deleted]
  • megous 2y ago
    If the news starts with "criminals stole..." and not with "poor security practices at XYZ resulted in..." then there's really no hope.
• BenFranklin100 2y ago
  This is a political problem. Until we pass laws that companies can be find liable for significant damages in the event of data breaches, we will see little progress on data security. This is an area where Congress needs to act. Current law does not adequately protect the public due to the difficulties in establishing standing, tying specific breaches to specific personal damages, other reasons. Such a law would seriously impact current practices of the majority of IT firms, including small app developers, which is why we see little push from silicon valley for such changes.
• oriettaxx 2y ago
  [flagged]
  • droopyEyelids 2y ago
    Public? not within our lifetimes. Available to hostile governments? More likely
    • pavel_lishin 2y ago
      A friendly government can turn hostile overnight.
  • deleted 2y ago
    [deleted]
• abduhl 2y ago
  >> AT&T said it learned of the data breach on April 19, and that it was unrelated to its earlier security incident in March. Why was this not disclosed on AT&T’s earnings call on April 24? At least someone will get compensated for the breach, although it’ll be the lawyers for the class action lawsuit that’s about to hit instead of the customers that got their information stolen.
• deleted 2y ago
  [deleted]
• graybeardhacker 2y ago
  Freeze your credit people! It's super easy. It's not a perfect fix but it's so trivial to do and it will help. https://www.usa.gov/credit-freeze https://www.usa.gov/credit-freeze You can unfreeze through an app whenever you want/need to.
  • pavel_lishin 2y ago
    Is there any reason not to keep credit frozen permanently, only unfreezing it when you're making a large purchase that requires it?
    • noodlesUK 2y ago
      Unfortunately it isn’t an option in every country. In the U.S., you can freeze your credit for free, but in the UK, you can’t. I think we should get rid of the CRAs entirely, but that’s a conversation for another day.
    • troyvit 2y ago
      That's what I do. It also slows my roll. It's an extra step I have to take before making that large purchase or applying for anything that requires a credit check.
      • yelling_cat 2y ago
        It's an extra step, but a surprisingly simple one. When I opened a checking account recently the bank told me which credit agency they'd use, and I unfroze that account and ChexSystems (another credit agency you should freeze with that is used specifically for new bank accounts) in five minutes using their automated systems. You can supply a re-freeze date when unfreezing as well so you don't need to remember to do that manually once you're approved.
    • k4j8 2y ago
      Keeping your credit frozen permanently is a great idea. Some of the credit agencies even encourage this with features such as a temporary unfreeze of your credit for a few days/weeks and then back to the permanently frozen state.
• zsdfgyn 2y ago
  Key point of the article: "Snowflake allows its corporate customers, like tech companies and telcos, to analyze huge amounts of customer data in the cloud. It’s not clear for what reason AT&T was storing customer data in Snowflake, and the spokesperson would not say." Finally journalists are asking the question why customer data must be stored with third party cloud providers. AT&T is a long way from Bell Labs, shame on them.
  • orochimaaru 2y ago
    All companies use third party cloud providers. A lot of legacy companies have been shutting down data centers to move to the cloud. So there isn’t a question of whether why your data is in the cloud. It’s going to be in the cloud.
    • sbarre 2y ago
      And honestly, I think I'd rather trust cloud providers with the data than the remnants of a decimated IT team in a large enterprise that's struggling to maintain their own on-prem infrastructure that's super old and probably not up to date on patches.
      • Andrex 2y ago
        The problem is then you have even fewer technically-competent people internally to actually manage the cloud, and combined with AWS's many documented footguns it's not clear to me the "new normal" is actually any better for security. You go from being a potentially-small-fry target to getting your data collated in massive breaches. There's risks to both.
        • orochimaaru 2y ago
          That’s the thing though - this was a snowflake breach. It’s not an AT&T miss because of their decimated sw engineering teams. Snowflake has much better sw engineering than AT&T.
• ChrisArchitect 2y ago
  Official support page: https://www.att.com/support/article/my-account/000102979/ https://www.att.com/support/article/my-account/000102979/
• jonplackett 2y ago
  Unbelievable that they do not enforce 2FA for a client that huge. Absolute madnesss!
  • Sylamore 2y ago
    What's odd is until August of last year I worked for AT&T and had to do 2FA for accessing almost every internal site I used, and that extended to most SSO integrated external sites - including the relatively small number of Snowflake instances I worked with. I do know that not every employee designation required universal 2FA but more or less all IT/ATO staff did.
• MOARDONGZPLZ 2y ago
  Is this leak why the spam next messages have gone from “Hi how is your day ?” or “Hi [not my name] please do thing X. Of you’re not [not my name] I’m so sorry perhaps we can be friends.” to “Hi is this [my full name]?” or “Hello [my first name] how is your day ?”
  • jeffwilcox 2y ago
    Any leak with your mobile and name pair could have done that. As a non-AT&T customer, I get the my-speecific-name pig butchering texts, too.
    • MOARDONGZPLZ 2y ago
      True. They’re brand new to me though. I’ve been getting the former for years, the latter for only weeks.
• iftheshoefitss 2y ago
  Same hackers as Twilio :) no amount of security would have prevented this
• bediger4000 2y ago
  That's an enormous amount of data. How do you not notice a huge, network-hogging data flow?
  • steelframe 2y ago
    > That's an enormous amount of data. How do you not notice a huge, network-hogging data flow? No it isn't. Not even close to some of the larger data sets that Snowflake most likely manages. We're talking about the public cloud. You don't "hog" AWS's network with a one-time download in numbers like what we're seeing from the article. Let's be generous and estimate that there are 1k records for each customer. That's almost certainly an overestimation for the time period that TFA specified, but for the sake of argument let's run with it. There are about 100M customers. So that's only 100B records. Assuming each record is on the order of 1kB in size, again likely a huge overestimation, then that would be just 100TB. AWS would charge $7k to egress 100TB, which would be a rounding error in AT&T's cloud spend. The real amount is most likely less than half of that, if not a quarter.
• the8472 2y ago
  The headline could equally say "AT&T kept data for criminals to steal". If wiretapping laws didn't exist then most of this data would not be justified to exist. Flat-rate billing doesn't need to keep track of this information. Even usage-based plans could keep cumulative records rather than individual ones, or at least delete them at the end of a billing period. Where there is a trough, pigs gather.
• throwaway120724 2y ago
  There's no way to make the software perfectly safe from hackers and from social engineering. So, yes, companies should be more careful with the data and, yes, the data shouldn't be kept forever. I agree companies should be doing more to protect the data. I see lots of outrage at the companies and why isn't the government doing more to punish them and how do I get compensated ... But, I feel like everyone is blaming the victim. Is it the home owners fault when someone breaks in and steals stuff? Where's the outrage at the hackers breaking into these accounts? Where's the "why aren't the governments tracking these people down?" Why is no one demanding that the hackers be brought to justice?
  • rightbyte 2y ago
    > But, I feel like everyone is blaming the victim. Is it the home owners fault when someone breaks in and steals stuff? > Where's the outrage at the hackers breaking into these accounts? The internet is essentially every hooligan in the world about to kick in your dooor. So yes, I blame the home owner. It seems silly to me to condemn anonymous users of the internet. Back in the days when nothing of importance was done on the internet the view was way more healty. If you have sensitive data, don't expose it to the hooligans. Easy as that.
  • metabagel 2y ago
    > There's no way to make the software perfectly safe from hackers and from social engineering. This is a straw man argument. Companies should use best practices in order to prevent most intrusions. When they do not, as in this case, criticism is warranted.
  • throwway120385 2y ago
    The problem with analogies is that they're a leaky abstraction. You're comparing a single person with maybe a handful of employees to a giant, multinational corporation with corporate offices, hundreds of thousands of employees, enough real-estate to create a small country, and billions of dollars per year in revenue. It's a false equivalence to compare this to door kicking like it was some kind of petty theft. They literally kept everyone's information in a machine that was connected to the internet and then didn't make any effort to treat that with the gravitas it deserves. They are not the victim here, we are. It's a little shameful that you don't see that.
• reify 2y ago
  [flagged]
• squeegee_scream 2y ago
  It's ok everyone! Protecting our data is one of AT&T's top priorities. > Protecting your data is one of our top priorities. We have confirmed the affected access point has been secured. > We hold ourselves to a high standard and commit to delivering the experience that you deserve. We constantly evaluate and enhance our security to address changing cybersecurity threats and work to create a secure environment for you. We invest in our network’s security using a broad array of resources including people, capital, and innovative technology advancements. I hope there's an enormous fine for this kind of negligence
  • nashashmi 2y ago
    Not their fault. Snowflake was breached. And the data was with Snowflake.
    • jeff_tyrrill 2y ago
      Your contractor being breached means you were breached.
    • hobs 2y ago
      Snowflake was "breached" by AT&T users using the same password in Snowflake and another system that was breached. This is just trivial pivoting done with some guesswork done fairly well.
    • nijave 2y ago
      Snowflake wasn't breached. A Snowflake database belonging to AT&T was breached.
      • nashashmi 2y ago
        You are right apparently. > hundreds of Snowflake customer credentials ... of staffers who have access to their employer’s Snowflake environment ... credentials available online linked to Snowflake environments suggests an ongoing risk to customers who have not yet changed their passwords or enabled MFA.
    • 2y ago
• OutOfHere 2y ago
  Unfortunate as it is, nobody genuinely cares about: 1. Preventing data breaches 2. Properly anonymizing aggregated personally identifiable data 3. Having and using a secure ID and verification system
  • gmd63 2y ago
    They don't care because they don't know how the systems they use daily work, much less the costs and risks involved. If they knew, they would care, and that's why representatives care on their behalf. You could say the same about health and nutrition, but people very much do care when a medical issue tangibly affects them negatively.
  • mv4 2y ago
    I am seeing this mentality as well, and it's disheartening. My company manufactures and sells a privacy-first, fully autonomous, on-prem, video security system for home and SMB. Yet, some people choose a cloud based service (convenient) and are surprised when their private data is either a) hacked, or b) abused by the provider's own employees (see the latest Amazon Ring settlement). With the latest scandals and breaches though, I feel it's gradually starting to change.
• stevetron 2y ago
  AT&T bought into a significant amount of DirecTV - so much so that everything that had the DirecTV logo on it was changed to the AT&T logo, such as the invoicing. So the AT&T customer base has included, for several years, the Directv customer base. The article doesn't attempt to clarify who the 'nearly all' customers are, and some people will jump to the conclusion that it is the cell phone customers. But it could include the DirecTV customer base whose data is also at risk.
  • vel0city 2y ago
    AT&T didn't just buy into a significant amount of DirecTV, they owned DirecTV. As in, 100% ownership. So yes, all DirecTV customers were AT&T customers, because AT&T and DirecTV were not separate entities. It wasn't until 2021 that DirecTV was spun off into a separate company again, but still with 70% ownership by AT&T.
  • hermitdev 2y ago
    AT&T does a lot more than just cell phones. Probably also the largest US ISP behind Comcast, I'd expect. I had AT&T fiber to the home at a previous residence, and that was a great product. Far superior to Comcast.
• MisterBastahrd 2y ago
  Be nice to have a new federal law: you get breached, you pay $5K plus lifetime credit monitoring to each person involved. Non-dischargeable by bankruptcy. No arbitration, no lawsuit. You pay.
  • joemi 2y ago
    Interesting idea, though I think that having it be $5K (or any fixed amount) no matter the size of the company favors large companies, since large companies can probably spend more to reduce the risk of getting hacked. Hell, it might even incentivize large companies to fund hackers to breach their smaller rivals, in order to wipe out their competition.
• skybrian 2y ago
  > Snowflake blamed the data thefts on its customers for not using multi-factor authentication to secure their Snowflake accounts, a security feature that the cloud data giant did not enforce or require its customers to use. And is that going to change?
  • dboreham 2y ago
    This is a diversion. Why did they build a system that permitted a bulk database dump of hundreds of millions of rows even with 2FA?
    • skybrian 2y ago
      Because that’s what a data warehouse is? You’d think they’d guard them more, though.
    • vel0city 2y ago
      > Why did they build a system that permitted a bulk database dump of hundreds of millions of rows Should all databases be capped at a few million rows total or something? I don't quite understand where you're going with this.
• deleted 2y ago
  [deleted]
• kjellsbells 2y ago
  I find it interesting that in your typical BigCo breach, they are at pains to point out that credit card details were not stolen. I infer from this that something about credit cards, and how they are secured, has real teeth and BigCo's lawyers are trying to stop them biting. Is this PCI-DSS? Maybe someone can comment. As far as this breach goes, I think it just confirms my gut feel that Snowflake are heading to the wood chipper.
  • jeff_tyrrill 2y ago
    I think it's a desperate attempt to downplay the severity in any way plausible, taking advantage of the fact that credit card numbers and social security numbers have been mythologized in the American consciousness as nearly-mystical totems of identity and security, as part of the "identity theft" meme, even though they play little role in actual information security or privacy.
• mensetmanusman 2y ago
  Nice way to rule out who is a spy or not. Nice.
• autoexec 2y ago
  > The company said the hack wouldn’t be material to its operations or negatively impact its financial results. And this is why consumers will continue to see their information compromised by companies who collect and retain more data than they need and then fail to invest the time and resources to protect it.
• JoshTriplett 2y ago
  "AT&T reveals it has records of cellular customers calls and texts" These records should have been deleted at the latest at the point where they're no longer relevant for billing. (Which also means that for customers with unlimited calling/texting, there shouldn't be any records in the first place.)
  • deleted 2y ago
    [deleted]
  • gumby 2y ago
    I believe this practice was followed only in postwar France, and I think even there has long been jettisoned. It's been a while since I got a French phone bill though.
  • xyst 2y ago
    AT&T is well known for working with NSA — 33 Thomas St [1] [1] https://theintercept.com/2016/11/16/the-nsas-spy-hub-in-new-york-hidden-in-plain-sight/ https://theintercept.com/2016/11/16/the-nsas-spy-hub-in-new-...
    • rockskon 2y ago
      That doesn't excuse this. If these records only existed so they could give them to the NSA at a later time, that further illustrates the dangers of accommodating the agency's desire for access to data generated from the U.S. Telecom backbone.
      • SoftTalker 2y ago
        If they are obligated to give the data to the NSA, they should give it to them in real time and then delete their own logs as soon as they no longer need them.
      • spencerflem 2y ago
        It does explain it though. By coincidence they also get billions of dollars in federal subsidies
• gumby 2y ago
  The data can be used for traffic analysis (number->number call data); "no PII" except it's pretty easy to match a number to a likely user. I'm an AT&T customer, and in my case I don't have a risk, but I can imagine this info could be very handy for divorce, custody, and corporate IP lawsuits. So worse than it might look to ordinary folks.
• spacephysics 2y ago
  Text meta data is an important distinction Still not good, but headline feels clickbait if I think my text messages leaked
  • ethbr1 2y ago
    That's still pretty gnarly in terms of social graphing though.
• SoftTalker 2y ago
  "While the data does not include customer names, there are often ways, using publicly available online tools, to find the name associated with a specific telephone number" In other words, your phone number and name is likely in a public record somewhere. It's not that private. The info leak should not have happened but in the grand scheme of things it's not that big a deal. "The content of the calls and messages was not compromised." The worst it does is reveal who has been sending messages to or calling each other.
  • BobAliceInATree 2y ago
    That metadata was can be terrible for many people like politicians, those having affairs, drug dealers or buyers, those with sensitive healthcare providers, and so on.
    • mass_and_energy 2y ago
      This. If you're in an abusive relationship and your abuser sees that you're calling a lawyer, a helpline, a family member etc, bad things can happen quite quickly. This information is non-public for a reason, and you don't have to be a drug dealer to be protected by it either.
      • SoftTalker 2y ago
        Yeah it's not good. But would be worse if the actual contents of the messages had been leaked. That said the few abusive people I know are not smart enough to find data dumps of AT&T call records on the dark web. Nor could they pay for them. Nor could they likely make sense of them. But I'm sure some could.
• CuriouslyC 2y ago
  Big breaches like this are gonna be wild with advanced GenAI. Combing through the shit for the diamonds provided some degree of limitation on the impact of big breaches in the past but all those calls are going to be accurately transcribed and mined by AI and the attackers are going to have a buffet of products and targets laid at their feet.
  • mass_and_energy 2y ago
    It's just metadata, no transcription of calls can take place. In the future, please read the article before engaging in the discussion of its content.
    • nunez 2y ago
      Metadata can be identifying enough. For example, given someone has this data and some local LLaMa variant on their machine, they could theoretically run a query like: "Give me all of the people that $NAME have called to, sorted by the number of times they called each other"
    • hulitu 2y ago
      > It's just metadata That's what they always say, honey, before calling the police. /s
• II2II 2y ago
  My first question is: why was the data being stored by a third party in the first place? Shouldn't data like this be stored completely independently of the Internet? Yes, I realize that does not guarantee it is secure since there has to be some point of access. On the other hand, it would reduce opportunities for people to breech the databases.
  • Cheer2171 2y ago
    Because they don't care about actual information security, they care about "national security." They optimize for giving all branches of US law enforcement, from the federal to state to local level, access to 7 years of historical data whenever they claim they need it.
    • II2II 2y ago
      I don't buy into that theory, at lrast in this case. There are other ways to hand-off data when it is legally requested. On the other hand, such data would be valuable to foreign actors who do not have a legal means of accessing such data. It would require a high degree of incompetence to sacrifice national security in the name of convenience.
• chasenjohnson 2y ago
  You would effectively be able to cross reference this meta data with 2 factor authentication services. It’s probably time to start removing this option entirely.
  • sedatk 2y ago
    How would cross-referencing be useful? You’d just find out what services people use?
    • rboyd 2y ago
      I guess after mapping the services used you would find the accounts worth going for and those become SIM swap targets
      • mikeocool 2y ago
        Seems like there's a lot of cross referencing well beyond MFA that this'll likely be used for. Way easier to target phish people's bank logins, if you know what banks they are regularly communicating with.
    • chasenjohnson 2y ago
      If GitHub always uses the same number(s) for 2fa and there are outgoing texts to your number then the connection is obvious. I’ve read that sim jacking is somewhat common and this would be a good data point.
      • sedatk 2y ago
        So, just for discovering what services people use?
• throwaway81523 2y ago
  This happened in 2022 and they're just disclosing it now? Or did they just find out about it, which is maybe even worse?
  • JohnMakin 2y ago
    The data was from 2022. The breach was from april of this year.
    • tardy_one 2y ago
      Who was the data being kept for?
      • JohnMakin 2y ago
        ATT did not answer this question. I would expect them to keep phone records going back a ways, but 2022 seems pretty far. I'd guess for law enforcement.
        • throwaway81523 2y ago
          I think there is a requirement to keep them 18 months. Any reasons to keep them in bulk for longer than that are probably bad.
      • weberer 2y ago
        Likely the NSA https://theintercept.com/2016/11/16/the-nsas-spy-hub-in-new-york-hidden-in-plain-sight/ https://theintercept.com/2016/11/16/the-nsas-spy-hub-in-new-...
  • deleted 2y ago
    [deleted]
  • molave 2y ago
    The authorities requested the delay of the disclosure: https://cbs58.com/news/nearly-all-at-t-cell-customers-call-and-text-records-exposed-in-a-massive-breach https://cbs58.com/news/nearly-all-at-t-cell-customers-call-a...
• mjevans 2y ago
  These are all security nightmares aren't they? It smells as if all the resources went into delivering billing, then barely enough for technically working service, and then is there even anything leftover for security (instead of this being part of the foundation of a service)?
  • hateful 2y ago
    Something happens when you tune your business only to the things you can measure. I still (or at least try to still) have this naive opinion that if you make a good product, the money will come. We sometimes spend too much time counting the beans and not enough time growing them. Not saying you don't need to count the beans, you do, but when your whole team is counting, they may forget to water them. Also - to be on topic - don't forget to protect the beans!
• deleted 2y ago
  [deleted]
• deleted 2y ago
  [deleted]
• deleted 2y ago
  [deleted]
• blessedwhiskers 2y ago
  The TechCrunch article indicates cell site identifiers were included, which means approximate location as well. https://techcrunch.com/2024/07/12/att-phone-records-stolen-data-breach/ https://techcrunch.com/2024/07/12/att-phone-records-stolen-d...
• dapearce 2y ago
  No dates or timestamps included meaning they were using the data to build a social graph.
• yiamvino 2y ago
  I might be lone wolf here but I kind feel pity for ATT I dont know why they are solely getting all the loathe here . actual incident occurred on public cloud provider who had not provided secure tools practice to their customer. so in this customer getting blamed for buying service cloud provider lack of best practices.
• DarkmSparks 2y ago
  Isnt this just a legally mandated api for all phone operators in the US? Edward Snowden published several slide decks about it a few years ago, before he defected to Russia.
  • lfmunoz4 2y ago
    [flagged]
    • booleandilemma 2y ago
      What do you think would have happened to him if he had stayed here? The last whistleblower the US government got to was imprisoned for seven years and identifies as a woman now. Snowden would be crazy to come anywhere near the US.
      • 1d22a 2y ago
        I'm not sure why gender identity is relevant. I agree that the punishments he would have gotten for whistleblowing justify him not staying in the US.
      • nolok 2y ago
        He didn't disagree with the need to leave for Snowden, he said it wasn't a defection. Snowden hasn't defected the US anymore than the Dalai Lama has been deflected Tibet. I guess "went into exile" would be the proper naming.
      • blueblob 2y ago
        The parent wasn't arguing he should come back but saying that "defected" is not the correct word. The correct phrase is probably "took asylum."
    • hn92726819 2y ago
      Why are you booing him? He's right! > to forsake one cause, party, or nation for another often because of a change in ideology I don't think he left because of a change in ideology.
• smcin 2y ago
  Some new news in the article and comment: - [security expert] "This [logs without timestamps] isn’t one of their main databases; it is metadata on who is contacting who. Its only real use is to know who is contacting whom and how many times." - [commenter] "I have a theory that this call log was being used for a national security investigation. Otherwise why would this rise to the level of public safety/national security exemption?" [with two DOJ-approved 1-month delays for disclosure] So, someone set up a separate Snowflake instance with mostly May-Oct 2022 AT&T data (90% former customers) apparently for that purpose. And left it up. Will anyone in Congress (e.g. Sen Ron Wyden) ask who did and why? (Another commenter on HN pointed out that Roe v Wade was overturned 6/2022, presumably that was not the intent of the original national-security investigation, but there's a potential for privacy abuse by the hackers' customers beyond everyday spam) - In early 2023, Snowflake set up a unit especially for Telco data. But when you read the blurb (below), this product is not aimed at the telco's use-case; coincidentally this was also around the time Snowflake was touting integration with GenAI. "Unlocking the Value of Telecom Data: Why It’s Time to Act" https://www.snowflake.com/blog/telecom-data-partnerships/ https://www.snowflake.com/blog/telecom-data-partnerships/ "Telecoms are the connecting tissue of the modern economy. They run everything... growing importance... hyperconnectivity. What makes telecom service providers unique is that they have access to consumer location data. For most other industries, a consumer can go into their phone’s privacy settings and turn off the location access in the smartphone app. But in the world of telecom, as long as the phone is connected to a network, the telecom provider can use triangulation to find the approximate location of a consumer. This is why there is an emerging trend of companies [which ones?] building partnerships with telecoms to power use cases across multiple industries from competitor intelligence, alternate credit scoring, hyper-targeted marketing and more. ... Yet, despite the importance of telecommunications for society and in connecting industries, network operators are not yet fully embracing the value of the data they have at their fingertips" But the value of this data (90% former customers) was clearly not to the telco itself... so who is the unnamed partnership and who is the end-customer? And was one of Snowflake's AI partners involved?
  • deleted 2y ago
    [deleted]
  • 2y ago
• riffic 2y ago
  did they just enumerate an open web endpoint for it or something?
  • nerdponx 2y ago
    The data was stored in a cloud data warehouse called Snowflake, which had a major breach recently.
  • itscrush 2y ago
    API based credentials are just username + password in this context, nothing else seems to be restricting access to data. So if your Snowflake tenant isn't enforcing IP restriction to limit source auth attempts, those creds can be used to pull the data from any source IP. Even then, you'll still have an HTTP 403 response layer filtering those auth attempts based on IP... where we can assume these failed to implement it. So far between TechCrunch, Wired, and other reporting it seems most claim creds get owned, sold, then used against under-restrictive Snowflake tenants which are exposed by default. i.e; https://epa06486.snowflakecomputing.com/console/login#/ https://epa06486.snowflakecomputing.com/console/login#/ here's someone's tenant, if you were able to go buy some creds for it, should walk right in. [edit] I have a more detailed Snowflake comment with references that might fill in better gaps here; https://news.ycombinator.com/item?id=40554753 https://news.ycombinator.com/item?id=40554753
    • lokar 2y ago
      You can use oath or rsa keypair for service account auth
• jensenbox 2y ago
  [flagged]
  • nvr219 2y ago
    Good advice whenever possible. I wish any of the companies I did business with would use Signal but they all use SMS only (like my doctors, my plumbers, the electric company, restaurants, etc etc)
  • deleted 2y ago
    [deleted]
• gz5 2y ago
  The root cause (1) is the data store should not have been available on the underlay network. Anything connected to an underlay network is a ticking time bomb. Any servers or admins which need to talk to the data store should instead use a private overlay (2) network. Any users (likely just remote admins) should do the same. (1) Same root cause as 99% of breaches and yet it is too often swept under the rug while we focus on the infinite # of proximate causes (2) Software, not private circuits.
  • jodrellblank 2y ago
    It seems from the article that AT&T uploaded data to a cloud service, protected by username and password, and someone obtained credentials or breached the cloud service. What does that have to do with 'underlay networks' and wow is that "the root cause of 99% of breaches"?
    • gz5 2y ago
      An attacker who gets username/pw still can't get on the overlay network (the overlay requires credentials which can't easily be stolen or compromised, e.g. a private key signed X.509 certificate). Yes, because 99% of attacks use the underlay network to access the target and exfiltrate the data. Said the other way, an attacker didn't physically walk into a Snowflake data center, console into the right server, and walk out with all the data.
      • Aloisius 2y ago
        That sounds more like the lack of certificate-based authentication (or some other stronger authentication method) was the problem, not the lack of a private overlay network. After all, plenty of private overlay networks use simple username/password auth or no auth at all.
        • gz5 2y ago
          Agree, good point, the overlay needs to do strong identity, authN, authZ. The critical part the overlay adds to traditional auth is making the server unreachable from the underlay networks, reducing attack surface by billions. Meaning: + Let's say the server did have good auth, but there was a bug, misconfig, zero day, etc. (one of the myriads of proximate causes). + Since the server is available on the underlay network, that vulnerability can be exploited by anyone on the underlay (billions Internet nodes). + In contrast, making the server only available on the overlay, reduces the attack surface from billions of Internet nodes to the nodes which can ID, authN and authZ (for that particular server) on the overlay.
• nequo 2y ago
  @dang Could I ask why this topic gets systematically penalized in the HN ranking? There have been 15 submissions so far, I assume partly because previous submissions are not shown on the main page so HN users keep re-submitting it. This topic is both newsworthy and high interest. (I was going to link to the 14 other submissions but the list is too long and it'd just come across as obnoxious.)
  • deleted 2y ago
    [deleted]
  • behnamoh 2y ago
    The new HN voting mechanism is broken imo. Useless posts and articles of low value make it to the frontpage but valuable ones get shadowed.
    • arrowsmith 2y ago
      There's a new voting mechanism?
      • robxorb 2y ago
        And where do we go to find out about these things? Is there a discussion space or something?
        • nvr219 2y ago
          Nah
  • nanidin 2y ago
    At the moment this is #1 on the frontpage.
  • bloopernova 2y ago
    The threads have probably tripped the flamewar detector. Certain amount of comments plus some other metrics will hide the thread from the front page.
• deleted 2y ago
  [deleted]
• darig 2y ago
  [dead]
• wly_cdgr 2y ago
  Why did it take them over a year and a half to disclose this?
  • u32480932048 2y ago
    Something, something, national security?
    • smcin 2y ago
      The DOJ approved two 1-month "delay periods", first in May, then in June, as part of the criminal investigation. We found that out earlier this morning, see earlier discussion.
  • JohnMakin 2y ago
    It didn't. The breach happened in april of this year. The data is from 2022.
• advael 2y ago
  It's disgusting that we still write headlines as "hackers steal" rather than "enormous company fumbles security for data they should never have retained"
  • SJMG 2y ago
    That is a good reframe.
  • mrbluecoat 2y ago
    How can I upvote this a million times?!
• not2b 2y ago
  "It remains unclear why so many major corporations persist in the belief that it is somehow acceptable to store so much sensitive customer data with so few security protections." It's because there are almost no consequences to them if they lose the customer data, beyond a day or two of bad press. If they faced significant fines, fines that get worse the more sensitive the data is, then they'd have an incentive to do better.
  • deleted 2y ago
    [deleted]
  • Jaygles 2y ago
    No consequences, the cost can be great, and it can negatively impact productivity by introducing hurdles to legitimate uses. Those are immense pressures a soulless company will need to overcome to do the right thing.
  • deleted 2y ago
    [deleted]
• fnord77 2y ago
  so just metadata, not the actual texts or PII
  • wordpad25 2y ago
    your phone number is PII and everybody you ever called or texted is VERY VERY PII
    • iftheshoefitss 2y ago
      [flagged]
  • macintux 2y ago
    “Just” is a dubious adjective in this context.
    • fnord77 2y ago
      some of the reports make it sound like the hackers are reading everyone's salacious texts
      • macintux 2y ago
        In a world where it's illegal in some places to help someone cross state lines for healthcare, phone records don't have to include content to be dangerous.
• RyanAdamas 2y ago
  Criminal charges need to be filed and class action lawsuit for fraudulent services for all the customers duped into renewing monthly services ignorant of the fact the service is not secure as plainly stated it must be in federal law.
  • deleted 2y ago
    [deleted]
• advael 2y ago
  At the scale of this kind of incompetent failure, no human being should be on board with the narrative that we should be blaming "criminals" for this If we don't hold companies accountable for keeping far more access and retention than should be legal, and securing their systems poorly, this situation will never get better
  • balls187 2y ago
    Who is the "we" here? And how should companies be held accountable? It's very rare for someone at the highest level to be held to any kind of liability, and paying fines rarely, if ever, causes these too-big-to-fail corporations to materially impact them. Strictly speaking about the US here.
    • advael 2y ago
      Needs to be at the level of enforcement by regulatory agencies, large scale lawsuits backed by state governments, and maybe even congressional action These companies have scale as their moat and that's called a monopoly. We need to be aggressively pursuing corporate malfeasance, closing loopholes, and breaking up companies. In my ideal world the entire doctrine of the "corporate veil" would be overturned, but that seems unlikely to happen without drastic upheaval. Antitrust action and large-scale suits can happen and to some degree those wheels are already in motion, but it would help a lot to stop buying this bullshit about how we should think of this as a "crime" for which we should uniquely blame hackers. These megacorps want to pretend that they and their customers are in solidarity as victims of the hackers. In reality, these companies get hit with essentially none of the consequences, and their practices are most of the relevant causal factors. A better model would be that the customers (and often non-customers on whom they collect data without even the figleaf of manufactured consent) are victims of the companies and the hackers
      • balls187 2y ago
        These companies are so massively large that they price in the risk of databreaches as a cost of doing business. Insurance Underwriters pour through corpo infosec documents, and require only the most basic level of protections. I think instead, a stricter certification standard needs to be created, and all these large companies must pass ANNUAL audits, or simply lose access to government leased spectrum.
• Animats 2y ago
  "still-unfolding data breach involving more than 160 customers of the cloud data provider Snowflake.' So what is Snowflake normally doing with all that AT&T data? Redistributing it to "marketing partners"? Apparently. Snowflake's mission statement, from their web site: "Our mission is to break down data silos, overcome complexity and enable secure data collaboration between publishers, advertisers and the essential technologies that support them." So this was not, apparently, a break-in to the operational side of AT&T. Someone unauthorized got hold of data they were already selling to marketers. Is that correct?
  • biggc 2y ago
    ATT could be using Snowflake for internal analytics
    • smcin 2y ago
      It's not "internal analytics", because a) 90% of the data was former customers and b) it has location data but timestamps were removed, so it's social-graph information plus location. Start asking yourself what sorts of end-users want to pay for the entire social-graph of 77m, regardless whether those customers never make a phone call again. "Alternate credit scoring, hyper-targeted marketing and more... an emerging trend of companies building partnerships with telecoms to power use cases across multiple industries." was the blurb for the unit Snowflake specially set up for Telco data in early 2023 touting "location data", but this product is not aimed at the telco's use-case; coincidentally this was also around the time Snowflake was touting integration with GenAI. (It's not "competitor analysis" either, because if it was they would have obscured the 68m former phone numbers to prevent abuse by direct-marketing.) [0]: "Unlocking the Value of Telecom Data: Why It’s Time to Act" https://www.snowflake.com/blog/telecom-data-partnerships/ https://www.snowflake.com/blog/telecom-data-partnerships/
      • Animats 2y ago
        Snowflake PR, from the link above: "What makes telecom service providers unique is that they have access to consumer location data. For most other industries, a consumer can go into their phone’s privacy settings and turn off the location access in the smartphone app. But in the world of telecom, as long as the phone is connected to a network, the telecom provider can use triangulation to find the approximate location of a consumer. This is why there is an emerging trend of companies building partnerships with telecoms to power use cases across multiple industries from competitor intelligence, alternate credit scoring, hyper-targeted marketing and more." That pretty much says it. It's disappointing that TechCrunch didn't point this out. Nor did the New York Times.[1] Yet it's right there on Snowflake's site. [1] https://www.nytimes.com/2024/07/12/business/att-data-breach.html https://www.nytimes.com/2024/07/12/business/att-data-breach....
• deleted 2y ago
  [deleted]
• deleted 2y ago
  [deleted]
  • deleted 2y ago
    [deleted]
• declan_roberts 2y ago
  I would like to sue AT&T in small claims for this and for leaking my Social Security number. But it's difficult to prove damages in these situations. Does anybody have any advice? Proving damages means showing actual monetary harm.
  • josh-sematic 2y ago
    IANAL but this would seem like a “class action” situation.
    • vdqtp3 2y ago
      I also ANAL but if I recall correctly, you can decline to be represented in the class, and file your own lawsuit
    • whalesalad 2y ago
      can't wait to get that check in the mail for $1.32
      • reaperducer 2y ago
        I got a check in the mail last week for 12¢ from Google hoovering up my data. Yes, that's twelve cents! Google certainly made more off of my data than that.
        • whalesalad 2y ago
          costs more to mail a letter
      • josh-sematic 2y ago
        True but personally I also wouldn’t want to go through the time and expense to sue them solo. At least in a class action the company faces some penalty that’s possibly meaningful to them (even if it’s not meaningful to most of the claimants).
    • voxic11 2y ago
• 1attice 2y ago
  this breach is of course appalling. But nearly as appalling is the experience of _explaining why this matters_ to non-technical friends who stare at you with blank, distracted eyes, but only for a second; for their phone (yes, the very phone that just exposed them to uncountable future ills) has chimed. I have nearly given up; like smoking, it will be decades before the harms are understood. We have to wait for your neighbour's brother to have died in a targetted political killing, because someone didn't like his Substack and borrowed the number and likeness of a friend; for his daughter's credit score to have been crushed by an anti-abortioneer who borrowed her face and likeness and number knew her first-grade teacher; for his son to die a death of despair, after making the wrong friends, and getting doxxed along with the rest of them. This should be a five-foot headline moment. But no; CNN will lead with Biden-mumbles or Trump-grumbles. How is it that the things that are killing us --- inequality, climate change, privacy collapse -- all have this same shape? Hamlets, all of us.
  • iftheshoefitss 2y ago
    I think humans are like corrupted, selfish and evil LLMs that like to think Utopia is possible if you think about it that way it’s super easy to understand
• whyenot 2y ago
  AT&T has 110 million customers. Let's be optimistic and assume that each customer only has to spend one minute of extra time managing their account due to the break-in. That is more than 209 years of lost time. Laws related to data breaches need to have much sharper teeth. Companies are going to do the bare minimum when it comes to securing data as long as breaches have almost no real consequences. Maybe pierce the corporate veil and criminally prosecute those whose negligence made this possible. Maybe have fines that are so massive that company leadership and stockholders face real consequences.
  • pcblues 2y ago
    Personal data cannot be secured. The only way is to not store it. That will (imaginationaly) cost companies in lost revenue for being unable to mine and sell it. Only government can make laws against a company taking your personal information and selling it. Even passwords shouldn't be stored by a company. The years of lost time argument is disingenuous. Over that number of people, 209 years of lost time from 700 million years of lives is nothing.
    • compootr 2y ago
      Whether or not it's disingenuous, it's our time that didn't need to be wasted in the first place by them not storing phone records
      • pcblues 2y ago
        I agree with that. I just don't like big numbers being used to cause emotional responses without proper context. Probably on a spectrum, but it's my beef :)
    • dopylitty 2y ago
      I’d take it a step further. If a technology is impossible to secure it shouldn’t be used. Maybe it’s time to rethink all the parts of our lives we’ve handed over to software.
      • 2y ago
• zombiwoof 2y ago
  User: admin Password: password
• chmod775 2y ago
  Over in Europe this blanket saving of phone records beyond what it is necessary to operate would have been illegal in many countries, and is in general incompatible with the European Convention for the Protection of Human Rights and Fundamental Freedoms outside of active threats to national security and temporary measures overseen by a court.[1] There's really no reason why any service providers should save this stuff in the first place, and it isn't hard to fix with legislation. Just make it illegal to even keep. [1] https://curia.europa.eu/juris/document/document.jsf?text=&docid=265881&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=4235302 https://curia.europa.eu/juris/document/document.jsf?text=&do...
  • deleted 2y ago
    [deleted]
  • Aerroon 2y ago
    I was under the impression that the government wasn't allowed to create a mandate that a telco has to save all phone records like that, but it doesn't stop a telco from doing it themselves. I think that would fall more under GDPR limitations?
    • chmod775 2y ago
      I believe you are correct. That's what I was referring to with "illegal in many countries". Most judgements on this issue predate GDPR, but before GDPR, many countries already had similar laws and attitudes. For example article 2* and 10 of the German constitution protect personal data and communication, not just from others, but also from the government. Not unlike the GDPR. Some service providers in Europe don't even want to save any data. The linked judgement above was the German state suing Telekom, which didn't want to save that data, and losing. Given the state of affairs, the question of "illegal or not" doesn't really come up as much. At least I'm not aware of any high profile judgements. Besides Telekom, which always tried to minimize they data they keep to the point of fighting it all the way to Europe's highest courts, most other telcos don't really care and pick whichever middle-ground is available between "must" and "must not". Whatever is least-likely to get them into trouble. Right now that just happens to mean "save little". * It's not stated explicitly in article 2, but the German constitutional court decided that it follows from those personal rights: https://en.wikipedia.org/wiki/Informational_self-determination https://en.wikipedia.org/wiki/Informational_self-determinati...
• deleted 2y ago
  [deleted]
• nxobject 2y ago
  I look forward to receiving my 30 cents in settlement money in five years.
• exabrial 2y ago
  The only "criminals" is AT&T for leaving the doors wide open.
• TriangleEdge 2y ago
  When are we going to see the technical report of what happened? Since this data has a specific time frame, it makes sense to me that a backup was stolen. But, we'll see. My guess is that the tech leaders a AT&T are going to have sore wrists for a few minutes because of this.
• smcin 2y ago
  Joining the dots on the facts so far, people don't seem to have grasped the apparent huge significance: - guessing it was some GenAI startup looking into consumer tracking, alternate credit scoring, surveillance or other national-security use-case. - Very unusually, the DOJ ordered two ~month-long "delay periods" in disclosure: ("The Justice Department determined on May 9 and again on June 5 that a delay in providing public disclosure was warranted"). Yet this didn't happen for Ticketmaster or MOVEit breaches revealed around the same time. "Cybersecurity delay period requests" is a new power quietly authorized by the DOJ+SEC+FBI, 18 Dec 2023 [0]. Note that [1] emphasizes this as "Corporate Alert - guidance for delay requests [on SEC 8-K]". Might Congress already have known/suspected, when it authorized the cybersecurity delay request powers, of the Snowflake/AT&T breach? Either way, whoever is involved seems to have very powerful friends. Also, the big FISA renewal vote was Apr 19 2024 [2]. - Seems the cloud instance was set up the same time GPT-4 was released (March 2023), also when Snowflake set up a Telco business unit [3] ("Location data... Alternate credit scoring, hyper-targeted marketing and more... an emerging trend of companies building partnerships with telecoms to power use cases across multiple industries"). This product is not aimed at the telcos' use-cases, but at new revenue streams. (Who might the unnamed Snowflake AI partner(s) be?) - They set up the Snowflake instance with AT&T/MVNO customers with timestamps removed, but with location data, yet the phone numbers not obscured or removed. Doesn't sound like "internal analytics" or "competitor analysis". What sorts of end-users want to pay for the entire social-graph of 110m, regardless whether those customers never make a phone call again? [EDIT: I confused the details of this AT&T breach with the other (2019) one disclosed on 3/2024: 77m AT&T/MVNO customers, 90% of them former customers] [0]: "FBI Guidance to Victims of Cyber Incidents on SEC Reporting Requirements: FBI Policy Notice Summary" https://www.fbi.gov/investigate/cyber/fbi-guidance-to-victims-of-cyber-incidents-on-sec-reporting-requirements-fbi-policy-notice-summary https://www.fbi.gov/investigate/cyber/fbi-guidance-to-victim... [1]: "US Corporate Alert - DOJ, FBI, and SEC provide guidance for delay requests relating to disclosure of cybersecurity incidents under form 8-K" https://www.klgates.com/DOJ-FBI-and-SEC-Provide-Guidance-for-Delay-Requests-Relating-to-Disclosure-of-Cybersecurity-Incidents-Under-Form-8-K-1-2-2024 https://www.klgates.com/DOJ-FBI-and-SEC-Provide-Guidance-for... [2]: US House approves FISA renewal – warrantless surveillance and all https://news.ycombinator.com/item?id=40041784 https://news.ycombinator.com/item?id=40041784 [3]: Snowflake cloud Telco unit, 4/2023: "Unlocking the Value of Telecom Data: Why It’s Time to Act" https://www.snowflake.com/blog/telecom-data-partnerships/ https://www.snowflake.com/blog/telecom-data-partnerships/
• jdlyga 2y ago
  It's one more reason to use an end to end encrypted messaging app like iMessage or Telegram. Even WhatsApp is end to end encrypted. Don't use SMS/RCS.
  • menacingly 2y ago
    unless I'm misunderstanding, the same data could be pulled from those services. the message content wasn't leaked here
• purpleblue 2y ago
  WHY IS THIS DATA EVEN AVAILABLE TO BE DOWNLOADED??? Why do we not have protection in place so that hackers can't even download this data even if they wanted to?? What purpose does 2 year old data serve AT&T except to monitor us and to create social networks of people and associations?
  • Ylpertnodi 2y ago
    Er....exactly.
• demondemidi 2y ago
  Would be great if some of the smart people here could help explain why this is such a big deal to my less tech savvy friends. I know that I don’t know how the data broker to dark web hacker pipeline works, I just know security is important. But my family is like “big deal”.
• benreesman 2y ago
  The old-timers remember a term: “dark fiber”. There’s going to be a lot of “dark compute” once we throw these lazy assholes out. Speaking for myself, I’m thinking of what the economics look like when HBM is abundant.
• guiambros 2y ago
  I cancelled my AT&T account over 10 years ago, yet they still stored my (old) address, full name, and SSN in the previous hack in March. The fact we don't have decent legislation to materially punish incompetent organizations is beyond absurd.
• hnpolicestate 2y ago
  If AT&T has the power to sell said data to whichever 3rd party it wants, why should this bother me?
• dbg31415 2y ago
  Or they just sold it / gave it to NSA and needed a cover story…
  • iftheshoefitss 2y ago
    Haha on bro we tried our best but they asked nice on bro
• jmount 2y ago
  And corporations like AT&T are themselves immune to having their own identities stolen (my notes: https://win-vector.com/2024/07/12/yet-another-way-corporations-outrank-people/ https://win-vector.com/2024/07/12/yet-another-way-corporatio... ). Corporate EINs (the US corporation equivalent to US social security numbers) and public. Knowing one doesn't let you commit identity theft and credit card against a corporation (unlike the case for people).
• berniedurfee 2y ago
  So is this data fair game to be used by lawyers and cops in the US? I guess maybe a cop would still need a warrant to use the data, but what about civil court cases?
  • itomato 2y ago
    They have a back door to the switches. They don’t need this.
• linda2244 2y ago
  [flagged]
• shironandonon_ 2y ago
  just put all information (names, addresses, ssn, DoB, etc) on a publicly visible blockchain already. Then there is no data left to breach. Instead develop systems to audit the usage of that blockchain and send to jail/military anyone who attempts to use that information in an unauthorized manner.
• r3trohack3r 2y ago
  Reading the articles about this breach and the nature of the data in this Snowflake lake, I personally wouldn’t consider this breach a “leak” from the customer perspective - to me the leak is upstream of this breach. Given the nature of the data in the database and the platform it was stored in, it seems extremely likely this data was not meant to be used internally by AT&T but was instead meant to be used externally by either a 3rd party partner (like advertisers and consumer analytics partners) or a government agency. In other words, if it were my data in this datastore, I’d consider my data as already having been “leaked” when it went into the store - the issue here appears to be that this data was “leaked” to the wrong people from the perspective of AT&T and the FBI.
  • khana 2y ago
    [dead]
  • Liquix 2y ago
    That's the issue with dragnet data collection and Snowflake-esque databases - it's never safe to enter any personal information on the internet. Given enough time, any and all of it will be "shared" and used for a third party's financial/political gain. Doesn't matter if it's AT&T, a bank, or the government. Never under any circumstances can you expect anything sensitive to stay private. This used to be taught as gospel when introducing kids to the internet - it's crazy how much things have changed in 20 years.
    • mr_toad 2y ago
      Given that most businesses and government agencies now allow remote access (i.e. WFH) all personal information is on the internet already.
  • 5g44b5nb45n 2y ago
    I wonder how many times Snowflake has openly transmitted CP from ATT customers because they are too hungry to ingest and sell data rather than verify it.
• banish-m4 2y ago
  AT&T - too big to jail, worst UX, worst service, and worst customer service ever. Until CEOs end up in prison, nothing will change and there will be no consequences. It will never happen because money has more votes than citizens.
• llm_trw 2y ago
  I about 6 years ago Iwas seriously wondering how snowflake could move so fast while keeping customer data secure... welllllll.
• hindsightbias 2y ago
  Does any organization, anywhere, alarm when a port exceeds a couple dozen TB of data? If they can lock down every phone use to a GB/month…
• kragen 2y ago
  wow, a spy agency acquired the entire social network graph of the usa in one intrusion. that's bad news for civil defense; it means they have a good guess at who is the favorite relative of each legislator, governor, police chief, or general. and where they can habitually be found at each hour of the week, since this leak included location data! how can we keep such accumulations of sensitive data from arising in the first place? only countries that figure it out are likely to survive the turbulent coming decades
  • EasyMark 2y ago
    How do you know it was a spy agency? Sounded like just a hacker group. I assume 5 eyes are the only ones who have this already anyway as a matter of course. All they have to do is buy it from AT&T, no hacking necessary.
    • kragen 2y ago
      it seems unlikely that it was just for the lulz. if the intruders are auctioning off the data, do you think the russian fsb, the ministry of state security, hizbullah, mossad, or the usdoj will bid highest? (the last, hypothetically, to destroy the data rather than use it for leverage in investigations—if not, it's in effect just another spy agency)
      • Ylpertnodi 2y ago
        Would they destroy only the hacked stuff? All the good info is still with the company..they can be hacked again.
        • kragen 2y ago
          sadly, they will
• pyuser583 2y ago
  Holy shit. If true …. Wow. This can be used for all sorts of evil.
• crmd 2y ago
  Airliner crashes would be as common as data breaches if regulators set the same expectations.
• deleted 2y ago
  [deleted]
• cynicalsecurity 2y ago
  In EU, this would have been a huge scandal. This would involve huge fines and the company would really try their best not to be so sloppy with data protection. But they are not in EU.
  • Ylpertnodi 2y ago
    It would be interesting if any ex-customers, living in the eu are affected - they may be covered by gdpr (though unlikely).
• luna4151 2y ago
  [dead]
• Tagbert 2y ago
  So, what is the actual threat from this? That someone now has my phone number (already public) and knows that I have called or texted with some other numbers? What is the risk in that? It’s not clear.
  • largbae 2y ago
    Well for one thing they can start figuring out who is not yet registered on Signal but would likely be in the phone contacts list of a rich person's number that they know. Social engineering attacks succeed with less.
• aorloff 2y ago
  I would say ATT ran afoul of a bunch of CA laws by putting this data on snowflake to begin with
• robxorb 2y ago
  Why is it "nearly all"? Which customers didn't have their data stolen and why were they magically left aside of this? It's obvious the data theives had complete dominance in the system so what query did they run to get only "nearly all"?
• xbmcuser 2y ago
  This data will be a gold mine for scammers. When they know relationships and real names of people they can target people as well create specific attacks for different people. Now with what LLM's are capable of mass social engineering is possible.
• greenavocado 2y ago
  Feds crucified weev in 2010 when he notified AT&T of exposed user data
• theGnuMe 2y ago
  They even got the data of former customers, like 10 year ago customers. That should be illegal. Your personal data should be deleted after you are no longer in business together.
• kator 2y ago
  I read an article in wapo that said you can use this URL to see what data was exposed: https://www.att.com/event/lander https://www.att.com/event/lander
• syngrog66 2y ago
  hold AT&T responsible. their officers. prison time. or this kind of carelessness with millions of people's lives will keep on happening if officers get million dollar paychecks they must also risk criminal penalties to balance out
• southernplaces7 2y ago
  Events like these will only become more prevalent as more personal, corporate and other information is digitized and stored by organizations too busy with other things to 100% button down their data (possibly an impossible thing anyhow), or simply too inept (a very common thing). There is a possible good side to it though, that it makes everyone, not just a few lone souls, much more conscious about privacy and rampant personal data collection, perhaps enough for a sea change in habits in the corporate and consumer worlds.
• deleted 2y ago
  [deleted]
• luna4151 2y ago
  [dead]
• telgareith 2y ago
  No mention of ITAR issues? In the comments?
• mikewarot 2y ago
  Why don't organizations hide their servers behind data diodes? Store everything in an air gapped network with strictly defined interfaces. I've been wondering this since the Office of Personnel breach[1] back in 2015. [1] https://en.m.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach https://en.m.wikipedia.org/wiki/Office_of_Personnel_Manageme...
• willfiveash 2y ago
  In the email I got from AT&T regarding this data breach was: "Protecting customer data is a top priority. We have confirmed the affected system has been secured. We hold ourselves to high privacy standards and are always looking for ways to improve our security practices." Well, now I feel better. 8^)