AT&T breach allowed customer data to be used to unlock smartphones
Social Security numbers were accessed in a bid to unlock smartphones
IDG News Service - Personal information, including Social Security numbers and call records, was accessed for an unknown number of AT&T Mobility customers by people outside of the company, AT&T has confirmed.
The breach took place between April 9-21, but was only disclosed this week in a filing with California regulators. While AT&T wouldn't say how many customers were affected, state law requires such disclosures if an incident affects at least 500 customers in California.
"Employees of one of our service providers violated our strict privacy and security guidelines by accessing your account without authorization," the company said in a letter to affected customers. "AT&T believes the employees accessed your account as part of an effort to request codes from AT&T than are used to unlock AT&T mobile phones in the secondary mobile phone market."
Many cellphones are provided by carriers with a software lock that prevents them from being used on the networks of competitors, but customers can typically request an "unlock code" that removes the restriction.
Once unlocked, they are more valuable on the second-hand market because they can be used on both AT&T and T-Mobile in the U.S. and the majority of cellphone networks around the world.
The company declined to comment on whether the phones had found their way to the second-hand market through legitimate channels or as a result of theft. Thousands of smartphones are stolen across the U.S. every year and are often sent overseas because of efforts by U.S. carriers to block their use within the country.
While inside customer accounts, those who accessed the data would have also had access to details of the time, date, duration and destination of phone calls made by customers, AT&T said.
"We recently learned that three employees of one of our vendors accessed some AT&T customer accounts without proper authorization," the company said in a statement.
"This is completely counter to the way we require our vendors to conduct business. We know our customers count on us and those who support our business to act with integrity and trust, and we take that very seriously. We have taken steps to help prevent this from happening again, we are notifying affected customers, and we have reported this matter to law enforcement," it said.
AT&T declined to provide any additional information on the incident.
Martyn Williams covers mobile telecoms, Silicon Valley and general technology breaking news for The IDG News Service. Follow Martyn on Twitter at @martyn_williams. Martyn's e-mail address is firstname.lastname@example.org
- 5 Things You Didn't Know About Cloud Backup IT departments are embracing cloud backup, but there's a lot you need to know before choosing a service provider. Learn all the critical...
- The 5 Big Lies About Going Mobile You've heard about the power of mobile to change your business. But have you realized your mobile potential? It's about much more than...
- BYOP: How Mobile and Social Are Creating New User Personas The digital world of mobile + social creates new customer segments and behaviors. Companies need to reorient their customer interactions around these segments...
- Big Data, Big Mess: Sound Risk Intelligence Through Complete Context This paper examines the insecurity of the small businesses in the supply chain and offers tips to close those backdoors into the enterprise.
- Data Protection and Disaster Recovery with iSCSI and VMware Get this on demand webcast now
- NSS Labs & Cisco Present: Evaluating Leading Breach Detection Systems Today's constantly evolving advanced malware and APTs can evade point-in-time defenses to penetrate networks. Security professionals must evolve their strategy in lockstep to... All Privacy White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!