Breachesby GlyphAT&T
Disclosed Mar 19, 2024110,000,000 affectedConfirmed
Call and text records of nearly all AT&T wireless customers stolen via Snowflake
AT&T disclosed that attackers accessed its workspace on a third-party cloud platform between April 14 and 25, 2024 and exfiltrated records of calls and texts from May to October 2022 and January 2, 2023 for nearly all of its wireless and MVNO customers. The Justice Department approved delaying the disclosure twice; AT&T said it would notify about 110 million customers.
What is known
| People affected | 110,000,000 (as reported by the organization) |
|---|---|
| Disclosed | Mar 19, 2024 |
| Discovered | Mar 26, 2024 |
| Happened | Mar 26, 2024 |
| Attack | Credential stuffing |
| Data exposed | NamesDates of birthEmailsGovernment IDsPhone numbersAddressesLocationOther |
| Sector | Telecom · US |
| Status | Confirmed |
| Lawsuit or fine | $177M class action settlement covering this and the March 2024 dataset incident (preliminary approval June 2025) |
| Part of | Snowflake (2024) |
| Check your email | Have I Been Pwned |
Sources
California Attorney General breach notice: AT&TWashington Attorney General breach notice: AT&TNotice letter filed with the Delaware DOJ: AT&TOregon DOJ breach notice: AT&TAT&T Inc. Form 8-K, Item 1.05 (2024-07-12)Have I Been Pwned: AT&TAT&T says criminals stole phone records of 'nearly all' customers in new data breachIndiana Attorney General 2024 data breach report: AT&T
Notices filed
Same campaign
Other breaches at AT&T
Dark web data set covers 73 million current and former AT&T account holdersExposed names, emails, phone numbers, addresses, dates of birth, Social Security numbers and credentials and tokens. Reported to the Vermont AG.73M affectedTelecomUSJul 13, 2023Breach, details not statedExposed names, Social Security numbers and phone numbers. Reported to the California AG.TechUSJun 11, 2014AT&T website flaw leaks email addresses of 114,000 iPad 3G ownersHacking exposed emails and names.Hacking114K affectedTelecomUSUnverifiedJun 9, 2010
History of this record
empty to or-doj: 51226382 (restored: the portal's own figure)by correctionSource
or-doj: 51226382 to by correctionSource
empty to https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Reportdec-2024.pdfby backfillSource
empty to snowflake-2024by seedSource
empty to $177M class action settlement covering this and the March 2024 dataset incident (preliminary approval June 2025)by seedSource
tech to telecomby seedSource
lost-device to credential-stuffingby seedSource
["names","dob","emails","government-id","phone","addresses"] to ["names","dob","emails","government-id","phone","addresses","location","other"]by seedSource
51226382 to 110000000by seedSource
In March 2024, tens of millions of records allegedly breached from AT&T were posted to a popular hacking forum . Dating back to August 2021, the data was originally posted for sale before later being freely released. At the time, AT&T maint to AT&T disclosed that attackers accessed its workspace on a third-party cloud platform between April 14 and 25, 2024 and exfiltrated records of calls and texts from May to October 2022 and January 2, 2023 for nearly all of its wireless and MVby seedSource
Material cybersecurity incident reported to the SEC (8-K Item 1.05) to Call and text records of nearly all AT&T wireless customers stolen via Snowflakeby seedSource
empty to AllegedATTby backfillSource
["names"] to ["names","dob","emails","government-id","phone","addresses"]by backfillSource
2024-04-09 to 2024-03-19by backfillSource
empty to In March 2024, tens of millions of records allegedly breached from AT&T were posted to a popular hacking forum . Dating back to August 2021, the data was originally posted for sale before later being freely released. At the time, AT&T maintby backfillSource
empty to Material cybersecurity incident reported to the SEC (8-K Item 1.05)by backfillSource
[] to ["names"]by backfillSource
empty to organizationby backfillSource
empty to 51226382by backfillSource
unknown to lost-deviceby backfillSource
empty to 2024-03-26by backfillSource
empty to 2024-03-26by backfillSource
First recordedby backfillSource
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.