4 ms·

Ongoing fallout from the Snowflake compromise; AT&T knew on Apr 19 but only disclosed now (Why does this not fall under SOX violation with the obligation to rep

by smcin 2y ago

Ongoing fallout from the Snowflake compromise; AT&T knew on Apr 19 but only disclosed now (Why does this not fall under SOX violation with the obligation to report timely to affected parties? It has affected AT&T's stock price -3% in early trading, so shouldn't it have also required SEC disclosure?) - Records downloaded from Snowflake cloud platform - AT&T will notify 110 million AT&T customers - Compromised data includes customer phone numbers, metadata (but not actual content or timestamp of calls and messages), and location-related data. Not SSNs or DOBs. Mostly during a six-month period 5/1-10/31/2022, but more recent records from 1/2/2023 for a smaller but unspecified number of customers. TechCrunch report has more details including Mandiant's response, the name and suspects location of the cybercriminal group I wonder if Congress manages to summon TikTok-like levels of anger on regulating this one.

softwaredoug 2y ago
> Snowflake blamed the data thefts on its customers for not using multi-factor authentication to secure their Snowflake accounts, a security feature that the cloud data giant did not enforce or require its customers to use. So AT&T put all our call information somewhere and hid it probably behind a weak password with no additional factors. IMO that's actionable negligence and I hope they get sued to oblivion.
- smcin 2y ago
  I'm more stunned that AT&T knew back on Apr 19 [UPDATE: Mar 20] yet feels it had neither an SOX violation or SEC obligation (share price effect) to notify timely. Like, by Apr 22. Not three months later [UPDATE: 4 months later]. Remember the massive Yahoo 2014 hack which Yahoo management failed to notify its own users for 2 years? If SOX violation only literally covers users' own passwords getting breached, but not 2FA or other passwords to access the same data, will Congress amend it urgently? EDIT: apparently they're hiding behind the 3/20 disclosure [0] which is all they disclosed until [1],[2] today. [0]: March 30, 2024 - "AT&T Addresses Recent Data Set Released on the Dark Web" https://about.att.com/story/2024/addressing-data-set-released-on-dark-web.html https://about.att.com/story/2024/addressing-data-set-release... > "AT&T has determined that AT&T data-specific fields were contained in a data set released on the dark web; source is still being assessed... > "AT&T has launched a robust investigation supported by internal and external cybersecurity experts. Based on our preliminary analysis, the data set appears to be from 2019 or earlier [incorrect], impacting... approx 7.6m current and 65.4m former AT&T account holders"* > "Currently, AT&T does not have evidence of unauthorized access to its systems resulting in exfiltration of the data set.... As of today, this incident has not had a material impact on AT&T’s operations."* [but did it have a material impact on the customers/ex-customers?!] [1]: Jul 12, 2024 - "AT&T Addresses Recent Incidents Regarding Access to Data" https://about.att.com/pages/data-incident.html https://about.att.com/pages/data-incident.html [2]: Jul 12, 2024 - "AT&T Addresses Illegal Download of Customer Data" https://about.att.com/story/2024/addressing-illegal-download.html https://about.att.com/story/2024/addressing-illegal-download... > "Based on our investigation, the compromised data includes files containing AT&T records of calls and texts of nearly all of customers of [AT&T’s cellular and (MVNOs) using AT&T’s wireless network], as well as AT&T’s landline customers who interacted with those cellular numbers between May 1, 2022 - October 31, 2022. The compromised data also includes records from January 2, 2023, for a very small number of customers. The records identify the telephone numbers an AT&T or MVNO cellular number interacted with during these periods. For a subset of records, one or more cell site identification number(s) associated with the interactions are also included."
  - smcin 2y ago
    Subsequent reporting reveals that the DOJ ordered two ~month-long "delay periods" in disclosure: > The Justice Department determined on May 9 and again on June 5 that a delay in providing public disclosure was warranted, so the company is now timely filing the report. > The company [AT&T] is working with law enforcement and believes at least one person has been apprehended, according to the filing. It does not expect the event to have a material impact on its financials. MarketWatch: [https://www.marketwatch.com/story/at-ts-stock-slides-2-9-after-company-discloses-hack-of-calls-and-texts-908a5fa1 https://www.marketwatch.com/story/at-ts-stock-slides-2-9-aft...]
amanaplanacanal 2y ago
According to CNN: “The company said the US Department of Justice Department determined in May and in June that a delay in public disclosure was warranted. It’s not clear why that the US government requested that data be delayed. CNN has reached out to the Justice Department for comment.”
- nimbius 2y ago
  May 16 Dow Jones Industrial Average surpasses 40,000 points for the first time, before closing at 39,869. public disclosure of a cataclysmic security breach in a darling of the stock market could have significant repercussions.
deleted 2y ago
[deleted]
adamtaylor_13 2y ago
It definitely included SSNs for some of them. Source: me. My data was included in the leak and it included my SSN. It’s been a cluster fuck of a cleanup.
- wredue 2y ago
  My SIN number has been leaked no less than 4 times tied to basically every standard identifying question about me now, if that helps ease your worry. I guess the new methodology is that a company cannot be sued if they just all leak data, that way nobody knows which one is responsible for your identity theft.

by smcin 2y ago

softwaredoug 2y ago

> Snowflake blamed the data thefts on its customers for not using multi-factor authentication to secure their Snowflake accounts, a security feature that the cloud data giant did not enforce or require its customers to use. So AT&T put all our call information somewhere and hid it probably behind a weak password with no additional factors. IMO that's actionable negligence and I hope they get sued to oblivion.

smcin 2y ago
I'm more stunned that AT&T knew back on Apr 19 [UPDATE: Mar 20] yet feels it had neither an SOX violation or SEC obligation (share price effect) to notify timely. Like, by Apr 22. Not three months later [UPDATE: 4 months later]. Remember the massive Yahoo 2014 hack which Yahoo management failed to notify its own users for 2 years? If SOX violation only literally covers users' own passwords getting breached, but not 2FA or other passwords to access the same data, will Congress amend it urgently? EDIT: apparently they're hiding behind the 3/20 disclosure [0] which is all they disclosed until [1],[2] today. [0]: March 30, 2024 - "AT&T Addresses Recent Data Set Released on the Dark Web" https://about.att.com/story/2024/addressing-data-set-released-on-dark-web.html https://about.att.com/story/2024/addressing-data-set-release... > "AT&T has determined that AT&T data-specific fields were contained in a data set released on the dark web; source is still being assessed... > "AT&T has launched a robust investigation supported by internal and external cybersecurity experts. Based on our preliminary analysis, the data set appears to be from 2019 or earlier [incorrect], impacting... approx 7.6m current and 65.4m former AT&T account holders"* > "Currently, AT&T does not have evidence of unauthorized access to its systems resulting in exfiltration of the data set.... As of today, this incident has not had a material impact on AT&T’s operations."* [but did it have a material impact on the customers/ex-customers?!] [1]: Jul 12, 2024 - "AT&T Addresses Recent Incidents Regarding Access to Data" https://about.att.com/pages/data-incident.html https://about.att.com/pages/data-incident.html [2]: Jul 12, 2024 - "AT&T Addresses Illegal Download of Customer Data" https://about.att.com/story/2024/addressing-illegal-download.html https://about.att.com/story/2024/addressing-illegal-download... > "Based on our investigation, the compromised data includes files containing AT&T records of calls and texts of nearly all of customers of [AT&T’s cellular and (MVNOs) using AT&T’s wireless network], as well as AT&T’s landline customers who interacted with those cellular numbers between May 1, 2022 - October 31, 2022. The compromised data also includes records from January 2, 2023, for a very small number of customers. The records identify the telephone numbers an AT&T or MVNO cellular number interacted with during these periods. For a subset of records, one or more cell site identification number(s) associated with the interactions are also included."
- smcin 2y ago
  Subsequent reporting reveals that the DOJ ordered two ~month-long "delay periods" in disclosure: > The Justice Department determined on May 9 and again on June 5 that a delay in providing public disclosure was warranted, so the company is now timely filing the report. > The company [AT&T] is working with law enforcement and believes at least one person has been apprehended, according to the filing. It does not expect the event to have a material impact on its financials. MarketWatch: [https://www.marketwatch.com/story/at-ts-stock-slides-2-9-after-company-discloses-hack-of-calls-and-texts-908a5fa1 https://www.marketwatch.com/story/at-ts-stock-slides-2-9-aft...]

amanaplanacanal 2y ago

According to CNN: “The company said the US Department of Justice Department determined in May and in June that a delay in public disclosure was warranted. It’s not clear why that the US government requested that data be delayed. CNN has reached out to the Justice Department for comment.”

nimbius 2y ago
May 16 Dow Jones Industrial Average surpasses 40,000 points for the first time, before closing at 39,869. public disclosure of a cataclysmic security breach in a darling of the stock market could have significant repercussions.

deleted 2y ago

[deleted]

adamtaylor_13 2y ago

It definitely included SSNs for some of them. Source: me. My data was included in the leak and it included my SSN. It’s been a cluster fuck of a cleanup.

wredue 2y ago
My SIN number has been leaked no less than 4 times tied to basically every standard identifying question about me now, if that helps ease your worry. I guess the new methodology is that a company cannot be sued if they just all leak data, that way nobody knows which one is responsible for your identity theft.