AT&T 2021 Data Breach
Company · Telecommunications and media services · Network infrastructure provider · USA
AT&T Telecom Breach (2021, Disclosed 2024): 49 Million Customer Records Including SSN, DOB & Government ID Exposed
Telecommunications company providing wireless, broadband, and related services.
Confirmed · ObscureIQ Intelligence
Breach Risk Index i
41/100
Lower riskHigher risk
Moderate: notable exposure with meaningful misuse potential.
Data Sensitivity i
ElevatedExposed data raises the risk of fraud, targeting, and impersonation. Proactive steps are warranted.
49.1MRecords
2021Year
The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.
Crucial data exposed
SSNSocial Security Number
Gov IDGovernment ID
AddressPhysical address
Breach Summary
AT&T, one of the largest wireless carriers in the United States, suffered a breach of approximately 49 million customer records traced back to 2021. The hacking collective ShinyHunters first advertised the stolen data for sale in August 2021, but AT&T initially denied that any breach of its systems had occurred. The data was later released freely on a hacking forum in March 2024, at which point AT&T acknowledged the records were authentic and contained data fields specific to the company. Whether the breach originated within AT&T's own environment or through a vendor has not been conclusively determined, though AT&T has stated it found no evidence of a direct network intrusion. A server misconfiguration is the identified attack vector. The exposed data includes names, email addresses, physical addresses, dates of birth, phone numbers, Social Security numbers, and government-issued IDs. The combination of Social Security numbers and telecom account access creates acute risk. Attackers can use this data to impersonate victims with carriers, execute SIM swap attacks, and then use control of a phone number to bypass two-factor authentication on bank accounts, email, and other services. AT&T reset customer account passcodes after confirming the breach, an acknowledgment that those credentials were likely compromised as well. AT&T's delayed confirmation, spanning nearly three years from the initial sale of the data to public acknowledgment, drew regulatory and legal scrutiny. In September 2024, AT&T reached a $13 million consent settlement with the Federal Communications Commission over a related vendor breach from 2023, with commitments to improve data governance practices. Class action litigation tied to the broader pattern of AT&T data incidents was consolidated into multidistrict proceedings, with a $177 million settlement receiving judicial approval in 2025. For affected individuals, the risk of identity theft, account takeover, and SIM swap fraud remains ongoing given the sensitivity of the exposed credentials.
Full threat analysis, exploitation vectors, and principal guidance below.
11 additional sections · verified field analysis · defensive doctrine
Querying breach corpus…
Cross-referencing exposed field types…
Resolving threat-actor attribution…
Compiling principal risk advisory…
49.1M records analyzed
About AT&T
AT&T is one of the largest telecommunications companies in the United States, providing wireless, broadband, and business communications services to tens of millions of customers nationwide. The company operates one of the country's largest wireless networks and has historically bundled telecom with media assets, though it has divested those holdings in recent years. AT&T is publicly traded and headquartered in Dallas, Texas.
Why They Hold Your Data
Telecommunications providers collect subscriber identity, phone numbers, service addresses, billing records, device data, SIM information, and account-management records across mobile and broadband services.
Recent Developments
AT&T has been reshaping itself into a pure-play connectivity company. In September 2024 it sold its remaining 70% stake in DirecTV to private equity firm TPG for approximately $7.6 billion, completing a full exit from the satellite television business it acquired in 2015. The company has publicly committed to focusing its investment on 5G wireless expansion and fiber broadband rollout. It has also faced sustained FCC regulatory scrutiny over its data handling practices across multiple incidents.
Data Points Exposed
7 verified field types
Date of Birth High
Email Address
Full Name
Government ID Critical
Phone Number
Physical address High
Social Security Number Critical
Breach Impact
AT&T initially denied the 2021 dataset was from its own systems when it first appeared for sale. It only acknowledged the breach in March 2024 when the full 73 million record corpus was made freely available. That delayed acknowledgment drew significant criticism and raised questions about the company's transparency obligations under breach notification law. In September 2024 AT&T reached a $13 million consent settlement with the FCC over a separate but related vendor cloud breach from 2023, committing to strengthen its data governance and supply chain oversight. Class action litigation related to the broader pattern of AT&T data incidents was consolidated into multidistrict proceedings, with a $177 million settlement receiving judicial approval in 2025.
Exploitation & Downstream Threats
• Identity theft and synthetic identity construction using government-issued IDs | • Identity verification bypass using name + date of birth combination | • SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure
Principal Risk Advisory
What this means for a principal
A telecom breach: subscriber and device data supports SIM-swap, account takeover and location inference. For a high-profile principal this is targeting-grade, not merely identity-theft-grade: the combination lets an adversary locate, impersonate, or pressure the principal with little additional work.
What You Should Do
- Freeze credit at all three bureaus and monitor for new-account and tax-refund fraud.
- Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
- Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
- Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.
How ObscureIQ Can Help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
S
Threat Actor: ShinyHuntersConfidence: High
Motivation: Financial extortion, data sale
A prolific data theft and extortion group that began as a database theft and resale actor and evolved toward SaaS-focused extortion. Recent activity involves vishing, credential harvesting, SSO compromise, and theft of customer data from cloud and SaaS environments.
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation