AT&T, one of the largest wireless carriers in the United States, suffered a breach of approximately 49 million customer records traced back to 2021. The hacking collective ShinyHunters first advertised the stolen data for sale in August 2021, but AT&T initially denied that any breach of its systems had occurred. The data was later released freely on a hacking forum in March 2024, at which point AT&T acknowledged the records were authentic and contained data fields specific to the company. Whether the breach originated within AT&T's own environment or through a vendor has not been conclusively determined, though AT&T has stated it found no evidence of a direct network intrusion. A server misconfiguration is the identified attack vector. The exposed data includes names, email addresses, physical addresses, dates of birth, phone numbers, Social Security numbers, and government-issued IDs. The combination of Social Security numbers and telecom account access creates acute risk. Attackers can use this data to impersonate victims with carriers, execute SIM swap attacks, and then use control of a phone number to bypass two-factor authentication on bank accounts, email, and other services. AT&T reset customer account passcodes after confirming the breach, an acknowledgment that those credentials were likely compromised as well. AT&T's delayed confirmation, spanning nearly three years from the initial sale of the data to public acknowledgment, drew regulatory and legal scrutiny. In September 2024, AT&T reached a $13 million consent settlement with the Federal Communications Commission over a related vendor breach from 2023, with commitments to improve data governance practices. Class action litigation tied to the broader pattern of AT&T data incidents was consolidated into multidistrict proceedings, with a $177 million settlement receiving judicial approval in 2025. For affected individuals, the risk of identity theft, account takeover, and SIM swap fraud remains ongoing given the sensitivity of the exposed credentials.

Telecommunications providers collect subscriber identity, phone numbers, service addresses, billing records, device data, SIM information, and account-management records across mobile and broadband services.

AT&T has been reshaping itself into a pure-play connectivity company. In September 2024 it sold its remaining 70% stake in DirecTV to private equity firm TPG for approximately $7.6 billion, completing a full exit from the satellite television business it acquired in 2015. The company has publicly committed to focusing its investment on 5G wireless expansion and fiber broadband rollout. It has also faced sustained FCC regulatory scrutiny over its data handling practices across multiple incidents.