Cyb3rius
@cyb3rius
· Aug 27
How did AT&T lose 110 million customer records?Hackers drained AT&T's call logs from Snowflake's cloud using stolen credentials that lacked multi-factor authentication.What happened: Between April 14 and April 25, 2024, the threat group UNC5537 accessed AT&T's workspace on Snowflake, dragging out call and text metadata for nearly every AT&T cellular customer. AT&T confirmed the breach on July 12, 2024, after discovering the files on May 13, 2024, and hired third-party researchers to verify deletion after paying a hacker.Key numbers: 110 million customer records exposed$370,000 paid in Bitcoin to a hacker for deleting the stolen data0 MFA protections enabled on the compromised Snowflake accountWhy it matters: The exposed data included phone numbers, call durations, and cell-site IDs, letting anyone map who you talk to and where you were—no password data but enough for targeted phishing and physical surveillance.Bottom line: No alternative: require MFA on every cloud account and continuously audit third-party access, because metadata like this can't be dressed up as safe.
0