AT&T Data Breach
Status: Confirmed
Breach Intelligence Summary
Entity: AT&T · Actor: ShinyHunters · Source: DataBreach.com / ObscureIQ intelligence
Attack: Data Scraping via Automated scraping
Timeline: Breach (Aug, 2021) · Reported (Mar, 2024) · Leak (12/1/24)
Exposure: 73.5M+ records · Dates of birth, Email, Government issued IDs, Home Address, Name, Names, Phone Number, Phone numbers, Physical addresses, Social Security Number
Status: Confirmed · Risk: High (Identity theft + Phishing / SIM swap)
Summary
AT&T Data Saga: From 2021 Leak Claims to 2024 Confirmation AT&T is still untangling the fallout from a huge cache of customer data-covering about 73 million current and former account holders-that first appeared for sale in 2021 and was finally confirmed as authentic in spring 2024. The dataset contains names Social Security numbers dates of birth and four-digit account passcodes. AT&T continues to investigate whether the records came from its own environment or from a vendor but it says there is still no evidence of an internal network intrusion. — , Breach Chronology
Aug 2021 – The hacking collective ShinyHunters advertises a trove of ~70 million AT&T records on RaidForums. AT&T states it can find “no indication” its systems were compromised. 17 Mar 2024 – A user calling themselves “MajorNelson” reposts what appears to be the same data-this time as a free 70 GB download on a hacking forum. Researchers confirm live SSNs and discover the “encrypted” passcodes can be brute-mapped back to plaintext. 26 Mar 2024 – AT&T lists 26 March as its official “date of discovery” in state regulator filings . 30 Mar 2024 – AT&T acknowledges the dataset stating it affects 7.6 million current and 65.4 million former customers. All current customers’ passcodes are force-reset. 2 Apr 2024 – AT&T emails notices confirming roughly 73 million individuals were exposed. Apr 2024 → – Multiple class-action lawsuits accuse AT&T of negligence and of delaying disclosure after the 2021 listing. , —
Personal identifiers: full name date of birth Social Security number Account details: four-digit wireless passcode/PIN contact information Data vintage: most records appear to pre-date mid-2019 Because the passcodes were hashed in a way that yields only 10 000 unique outputs attackers (and researchers) could reverse them quickly-one reason AT&T reset passcodes for all 7.6 million active customers. , —
Investigation – A “robust” forensics review with external experts to determine whether the source is internal or an outside partner. Notifications – Email and postal letters to current and former customers; ongoing outreach to any additional individuals identified. Mitigation – Automatic passcode resets for current customers free credit-monitoring and identity-protection services and reminders to watch financial accounts for suspicious activity. Litigation – AT&T faces a growing stack of federal lawsuits over alleged failure to safeguard data and alleged delay in confirming the breach. AT&T says the incident has not had a material impact on its operations though reputational and legal risks remain. —
Related AT&T Security Incidents
March 2023: ~9 million wireless customers had certain CPNI exposed after a third-party marketing vendor was breached. June 2024 (separate event): AT&T disclosed that call-detail records for ~109 million lines had been scraped from a misconfigured Snowflake data environment. —
Long lag between rumor and confirmation – Data first surfaced in 2021 but AT&T validated it only after the full archive was re-leaked in 2024. Uncertain breach vector – Whether attackers penetrated AT&T directly or siphoned data from a vendor remains unresolved. Weak passcode hashing – Four-digit PINs were “encrypted” in a way that allowed trivial full reversal. Ongoing legal exposure – The 2024 acknowledgment triggered a wave of class actions and heightened scrutiny of AT&T’s data-protection practices. What customers can do: Verify that your account PIN has been reset enable multifactor authentication where available, and monitor credit reports and financial statements for anomalies.
About AT&T
AT&T is the organization affected by this breach. User data may have been generated through account creation, service usage, or business operations.
If you have interacted with AT&T in any capacity, your data may be included in this breach.
Threat Actor: ShinyHunters
This breach has been attributed to ShinyHunters. The group is known for data theft campaigns targeting organizations through various intrusion methods.
- Automated scraping
Breach Exploitation Status
High
Status
Detected
Possible
Detected
Possible
Unknown
Indefinite (critical identifiers)
SSNs and government IDs never expire. This data can be used for identity theft years or decades after exposure.
Data Points Exposed
Dark Web Verification
Status: Confirmed
- Dataset containing approximately 73.5M+ records has been identified in breach intelligence sources.
- The data is indexed and searchable across breach notification platforms.
Impact
This breach carries high risk due to the nature of exposed data fields and the scale of affected records.
- Targeted phishing referencing AT&T accounts or services
- Identity theft using exposed Social Security Numbers
- SIM-swap attempts where phone numbers are present
- Physical mail scams and address-based identity verification fraud
- Age/DOB used to bypass identity verification questions
- Data broker enrichment and resale
Recommendations for Impacted Individuals
If you believe your information may be included:
Non-clients may request a breach impact review.
AT&T account updates
Password reset requests
Verify directly through official channels.
Email compromise is often the first pivot point.
Frequently Asked Questions
In Aug, 2021, AT&T experienced a data breach that resulted in the exposure of approximately 73.5M+ records containing personal information.
The exposed data includes Dates of birth, Email, Government issued IDs, Home Address, Name, Names, Phone Number, Phone numbers, Physical addresses, Social Security Number.
Approximately 73.5M+ records were affected based on current breach intelligence.
Yes. This breach is treated as confirmed based on data observed in breach intelligence platforms.
Data circulation has been detected across breach-sharing channels. Downstream exploitation risk exists based on the nature of the exposed fields.
Rotate passwords associated with AT&T, enable multi-factor authentication on email and financial accounts, and monitor for suspicious activity.
Protect Yourself
Check If You’re Affected
Enter your email to check if your data appears in this breach.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-net-worth individuals face elevated risk. Our team provides full-spectrum exposure audits and threat monitoring.
Corporate Accountability
Organizations that collect personal data have a duty to implement reasonable safeguards and to notify affected individuals when breaches occur.
Scope assessments may evolve as investigations continue. Users should not rely solely on early estimates when making risk decisions.
ObscureIQ Advisory
We combine proprietary dark web access with commercial and restricted breach intelligence to verify exposure and assess real-world risk.
- A public-facing individual
- A high-profile executive
- A customer of AT&T
- Or simply concerned about credential reuse
We can confirm whether your information is circulating and evaluate downstream threat vectors.