Friday, December 1, 2023

AT&T Vendor Hacked – Over 9 Million Customers Data Exposed

The “Customer Proprietary Network Information (CPNI)” from some wireless accounts was accessed by an unauthorized person, according to AT&T, who discovered the breach in a vendor’s system.

Over 9 million AT&T customers were informed that some of their information had been compromised.

“We recently determined that an unauthorized person breached a vendor’s system and gained access to your “Customer Proprietary Network Information” (CPNI)”, in a notice sent to an AT&T customer.

CPNI is information related to the telecommunications services customers purchase, such as the number of lines on your account or the wireless plan to which you are subscribed.

Which Information Was Revealed?

The first name, wireless account number, wireless phone number, and email address of the customers were among the information exposed, according to AT&T, which also provides additional details about the issue on their website.

“It also included the number of lines on the account and basic device (e.g., iPhone 7) and installment agreement information that was used to help indicate device upgrade eligibility”. 

“A small percentage of impacted customers also had exposure or rate plan name, past due amount, monthly payment amount, various monthly charges and/or minutes used”, according to AT&T.

They also highlight that “No credit card information, SSN, date of birth, account passwords, or specific device IDs (e.g., IMEI or SIM) was involved,” and that the customer information was several years old.

The company noted that the vendor security breach did not affect its systems and that the leaked data mostly related to eligibility for device upgrades.

“We have notified federal law enforcement about the unauthorized access of your CPNI as required by the Federal Communications Commission,” said AT&T, first detected by

 “Our report to law enforcement does not contain specific information about your account only that the unauthorized access occurred”.

Customers who already have an AT&T account are urged to consider adding their free “extra security” password protection to the account.

Users are urged to disable CPNI data sharing on their accounts by submitting a CPNI Restriction Request in order to mitigate their exposure risks in the case that AT&T decides to use the data for third-party vendor marketing in the future.

Network Security Checklist – Download Free E-Book


Latest articles

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...

CISA Warns Hackers Exploiting Wastewater Systems Logic Controllers

In a disconcerting turn of events, cyber threat actors have set their sights on...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles