What we know about the AT&T data breach affecting millions of current and former customers

AT&T reported Saturday that personal data from millions of current and former account holders has leaked onto the dark web.

The Dallas-based company said the data – which it said appears to be from 2019 or earlier – was released on the dark web about two weeks ago, and that officials had not yet determined where it originated .

Here’s what we know:

How many people were affected?

Officials with the telecommunications giant said a preliminary analysis found the data set includes information from about 7.6 million current account holders and 65.4 million former ones, totaling about 73 million people.

Anyone who has been impacted will get an email or letter from the company.

In an email to customers, AT&T said that to the best of its knowledge the data does not contain personal financial information or call history.

However, officials said the information released may have included full names, email addresses, phone numbers, Social Security numbers, and AT&T account numbers and passcodes.

AT&T told customers in an email that it will provide complimentary identity theft and credit monitoring services if their sensitive personal information was compromised.

What do I do if I’m affected?

AT&T has already reset passcodes – personal identification numbers, or PINs, that are an extra security measure for account holders.

Officials are advising all customers to change their passcode as a precaution.

People should monitor their credit report and use two-factor authentication for every one of their accounts, said Andrew Sternke, CEO of Southlake-based DarkBox Security Systems.

“The real issue here is the fact that basically all the personal identifiable information that you would need to basically re-create a person in the cyberspace was leaked,” Sternke said.

Brett Callow, a threat analyst with the cybersecurity firm Emsisoft, said affected customers should sign up for the credit monitoring services if offered. He also urged people to consider putting a block on their credit to stop fraud from happening.

Has this happened before?

In 2021, threat actor ShinyHunters made claims that it was selling data on 70 million AT&T customers.

The company said then that the information did not come from AT&T, and that officials would not speculate on whether the data was valid, tech outlet BleepingComputer reported.

Users on one hacking forum, BreachForums, appeared to suggest that the current data breach is a repost of the initial leak from 2021, but AT&T officials have not confirmed that.

Company officials said the company doesn’t have evidence at this point of unauthorized access to its systems and that it’s not sure whether the data originated from the company or one of its vendors.

Have similar companies had data breaches?

Yes, in fact, AT&T’s main competitors have dealt with data breaches in recent years.

Last year, T-Mobile said a “bad actor” accessed personal data from 37 million customers, CNN reported.

In 2022, the company agreed to pay $350 million to settle class-action lawsuits from a data breach disclosed in 2021 that affected a little over 40 million people.

Verizon has also been victimized by data breaches in the past, with the company saying at least 6 million customers were affected in 2017.

It has said that none of the information made it into the wrong hands.