ATLANTA — AT&T, the largest wireless mobile provider in the United States, is notifying its users of a data breach that released millions of customers' information on the dark web.
In a statement released on Saturday, the telecommunications giant said that the leaked data appears to be from 2019 and earlier, which impacts roughly 7.6 million current AT&T account holders and around 65.4 million former customers.
The leaked data includes personal information such as social security numbers. AT&T is still evaluating the source of the data.
AT&T said in the statement they are unsure if the data came from one of its fields or a field of one of its vendors. They also said they don't have any evidence of any sort of unauthorized access to its systems that could have resulted in this breach.
"The company is communicating proactively with those impacted and will be offering credit monitoring at our expense where applicable. We encourage current and former customers with questions to visit www.att.com/accountsafety for more information," an AT&T spokesperson said in a statement.
AT&T customer Coy Flynn said he has concerns.
"I don't have too many secrets to hide, if anything, being put on the dark web, but I definitely, like everybody else, just don't want all of our personal information out there," Flynn said.
Kennesaw State University cybersecurity researcher and assistant professor Andy Green said personal information is likely on the line.
"And that data has names, addresses, social security numbers, date of birth, and phone numbers--sensitive data," Greens said.
Green said the company is closing the barn door after the horse is gone.
"The troubling part here is that we are basically almost three years down the road and AT&T still has no basic idea about what in the hell is going on," Green said.
And while AT&T's experts figure it out, several customers can be victim to more scams.
"That's still all valuable data, no matter whether you're an AT&T client or not because we carry the number with us nowadays," Green said. "If I change providers, I still keep the same phone number. So, threat actors still know a bit about me and know how they can triangulate that data to find out more about me. And the really troubling part here is that if any of these customers who are in that breach from 2021 are still AT&T customers, it's nothing for a threat actor to send an SMS or a text message to a potential victim and say, 'Hey, we're here from AT&T support. We want to help with something. Click on this link.' And then, we go down that road, and eventually, something gets compromised," Green said.
Then, they're back down the rabbit hole.
The silver lining: Green said if you became a customer after Aug. 2021, you're probably safe. However, he believes people are getting too used to data breaches because they're happening more and more often.
AT&T customer Kimberly Angelone said she isn't worried.
"I have no concerns," Angelone said. "I think that if something does come up, I'll probably just change a few passwords."
Green suggests customers use multi-factor authentication, never repeat the same password, freeze their credit profiles and monitor them, and hope for the best.
"Whatever the issue is, hopefully, they can get it fixed," Flunn said.
"Don't panic. Don't overreact," Green said. "Take the steps that I've, that I listed previously, to help protect yourself going forward. And keep an eye on things and hope for the best."
AT&T customers experienced a nationwide cellular outage in late February, citing a coding error for the reason. However, the wireless giant explained that this data breach is not associated with last month's outage.
All customers were credited $5 back to their accounts, as roughly 73,000 customers reported network outages, according to Downdetector.
AT&T carries wireless service for more than 240 million subscribers, which is almost 100 million more than the second-largest wireless carrier, Verizon.