The AT&T data breach, explained

Two separate AT&T breaches in 2024 put the details of well over 100 million people in criminal hands. What happened, what the courts decided this month, and what to do if you were a customer.

HARD JournalPrivate cybersecurity · 7 min read

"The AT&T data breach" is really two. In March 2024 a file holding the personal details of about 73 million current and former customers, Social Security numbers included, turned up on a criminal forum. In July 2024 AT&T said that thieves had also taken the call and text records of nearly all its wireless customers from a cloud account. This month, a US federal court gave final approval to a US$177 million settlement covering both. You may be in one of them if you held an AT&T account before 2020, used AT&T wireless or a network that runs on it in 2022 or early 2023, or spoke to someone who did.

What happened, and when

How they got in

The March leak. We still don't have a public answer. AT&T said it hadn't determined whether the data came from its own systems or a supplier's. It said the data appeared to be from 2019 or earlier and didn't include financial information or call history. Press coverage noted a similar claim of a 70 million customer theft in 2021, which AT&T had not acknowledged. We've found no regulator or court that has settled the question, so we won't either.

The Snowflake theft. In 2024 criminals used stolen passwords to access dozens of companies' accounts on Snowflake. Reporting says AT&T's account wasn't protected by a second login step. US prosecutors say the campaign reached more than 165 organisations. The stolen logins belonged to Snowflake's customers; Mandiant found no breach of Snowflake's own systems. AT&T's data sat in its account on Snowflake's cloud service, with an old copy of customer call records in it.

Wired reported that AT&T paid a hacker about US$370,000 in May 2024 to delete the stolen call records, and that a video of the deletion was supplied as proof. AT&T hasn't confirmed this, and a deleted file is only ever a promise. Moucka pleaded guilty in August 2026 to four counts, including computer fraud and aggravated identity theft. John Binns was indicted in November 2024. We haven't seen sentences.

The data sat in a cloud account, and the login had one password on it.

Who was affected

The two breaches overlap, but they aren't the same people.

• March leak: about 73 million current and former account holders. If you had an AT&T account before 2020, even one you closed years ago, assume you're in it. Social Security numbers are the part that does lasting damage, because they don't change.
• Snowflake records: AT&T wireless customers and customers of other brands that run on AT&T's network, for 1 May to 31 October 2022 and 2 January 2023. Landline and other-carrier numbers that called or texted those wireless numbers in the same periods also appear in the records. The records show who you spoke to, not what you said. For most people that's an annoyance. For someone whose contacts include a lawyer, a doctor, a journalist, a board member or a source, it's a map of their life.

The settlement site, run by Kroll, was the official place to check whether you were included. AT&T also said it would write to affected people.

What AT&T and the regulators did

• AT&T: reset the passcodes of affected current customers, offered free credit monitoring, and said neither incident had a material impact on its business.
• Courts: a federal judge in Texas approved a US$177 million settlement. People with documented losses traceable to the first breach could claim up to US$5,000, and up to US$2,500 for the second. Court-appointed administrators estimated that most people who claimed without documented losses would receive roughly US$6.50 to US$40. The claim deadline was 18 December 2025. Money starts moving once the appeal period ends and any appeals are settled.
• Regulators: in September 2024 AT&T agreed to pay the FCC US$13 million over an earlier, separate breach: a supplier had held old customer records far longer than it should have, and thieves took them in 2023. It isn't either of these two, but it's the same pattern.

Why it still matters for a household or an executive

A leaked Social Security number, home address and date of birth doesn't expire. The data now sits in more hands than the original thieves'. Combined with call records, it lets a scammer sound like someone who knows you: who your contacts are, who you ring most, and when.

The phone number itself is the other risk. Many accounts reset their passwords by text. Someone who can persuade a carrier to move your number to their SIM, a SIM swap, receives your codes. A name, address, date of birth and a known contact list is most of what a convincing caller needs.

What to do today

1. Freeze your credit.If you're in the US, freeze your file at all three bureaus, Equifax, Experian and TransUnion. It's free, doesn't touch your score, and stops most new accounts being opened in your name. Elsewhere, ask your national credit bureau for the equivalent. Lift it briefly when you apply for credit.
2. Lock your number to you.Ask AT&T, or whoever now carries your number, to add a number lock or port-out protection and a long account passcode that isn't a birthday. Tell them you want no SIM changes without an in-person check. Do the same for anyone in the household whose number is on your plan.
3. Move codes off text where you can.Use an authenticator app or a passkey for email, banking and the apps that hold money. Your email is the one to do first, because it resets everything else.
4. Change anything that shared a password with an old AT&T account, and use a password manager so each one is different. If you ever used an AT&T or att.net email, check that inbox's recovery settings too.
5. Expect the follow-on scams. "Fraud department" calls that quote your address, texts about a "suspicious AT&T login", and mail offering to help you claim from the settlement. If someone calls you, hang up and ring the number on your card or bill. The settlement administrator will never ask you to pay to claim.
6. Watch your credit report and bank statements. Free weekly reports are available from the three bureaus at annualcreditreport.com in the US. Look for accounts you didn't open.
7. If your work involves confidential contacts, assume the call-record map exists. Tell the people you speak to most, and move the most sensitive conversations to an app with end-to-end encryption.

None of this is difficult, but it's a lot of small jobs across accounts and family members, and the order matters. Doing it once, properly, for a whole household is part of what private cybersecurity is for. Our essay explains how the companies that hold your data are a way in, and the PHP flaws we wrote about this week are another example of the same gap. If your Social Security number was also in the National Public Data breach, the steps above matter twice over.

Sources