AT&T Careers 2025 Data Breach
Employment / Job Search
AT&T Careers 2025 Data Breach
A job search service in the employment sector.
Confirmed · ObscureIQ Intelligence
Breach Risk Index i
39/100
Lower riskHigher risk
Moderate: notable exposure with meaningful misuse potential.
Data Sensitivity i
StandardExposed data is largely lower-sensitivity. Standard identity-protection precautions are advised.
563KRecords
2025Year
The Breach Risk Index (BRI) is a proprietary 0–100 score rating how dangerous a breach is right now, based on how recently the data has been circulating on the dark web and how valuable it is to attackers.
Breach Summary
October 28th 2025, 8:00 pm EDT, The Everest ransomware group, claims, to have stolen about, 576,000 applicant and employee records, from AT&T’s job-application portal (att.jobs). The company, has not confirmed, any compromise, and the claim remains, unverified, as of publication., Context, Everest is a long-running extortion group that publishes stolen data when victims refuse to negotiate.
Full threat analysis, exploitation vectors, and principal guidance below.
11 additional sections · verified field analysis · defensive doctrine
Querying breach corpus…
Cross-referencing exposed field types…
Resolving threat-actor attribution…
Compiling principal risk advisory…
563K records analyzed
About AT&T Careers
AT&T Careers is a job search service in the employment sector.
Why They Hold Your Data
AT&T Careers is a job search service in the employment sector. Services like this typically hold email addresses, names, phone numbers through account registration and normal operations.
Recent Developments
The AT&T Careers dataset circulated publicly; treat as part of the standing exposure landscape.
Data Points Exposed
3 verified field types
Email Address
Full Name
Phone Number
Breach Impact
The exposure created downstream fraud and phishing risk for those affected and drew scrutiny of AT&T Careers's data protection.
Exploitation & Downstream Threats
• SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses
Principal Risk Advisory
What this means for a principal
A consumer-service breach: contact and account data supports phishing, account takeover and profile enrichment. For a high-profile principal the main risk is credible impersonation and enrichment of existing exposure.
What You Should Do
- Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
- Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.
How ObscureIQ Can Help
- Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
- Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
- ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).
E
Threat Actor: EverestConfidence: High
Motivation: Financial
An extortion operation active since at least 2020. Everest evolved from ransomware and data extortion toward initial access brokerage and leak-based extortion.
Protect Yourself
Check If You're Affected
Enter your email to check whether your data appears in this breach. We’ll send a 6-digit code to confirm it’s your address.
Get Free Breach Alerts
Be the first to know when new breaches are disclosed. Free forever — confirm your email with a 6-digit code.
High-Risk? Get an Exposure Audit
Executives, public figures, and high-visibility operators can receive tailored exposure intelligence and hardening guidance.
Request Consultation