Overview:
AT&T is one of the largest telecommunications companies in the United States, serving over 100 million wireless customers and handling critical communications infrastructure for both consumers and businesses.
What Happened:
Hackers affiliated with the ShinyHunters group breached AT&T Wireless systems, stealing data on over 110 million customers. AT&T paid a $370,000 ransom to prevent data publication, but threat actors leaked 31 million additional records later.
Business Impact:
- Financial Loss: $127 million in incident response, customer protection, and regulatory fines
- Downtime: 45 days for comprehensive security review
- Reputational/Legal Effects: 110+ million customers affected, ongoing FCC investigation, class-action lawsuits
Response & Recovery:
- Detection Time: 21 days after initial compromise
- Recovery Actions: Ransom payment, customer notification, enhanced security measures
- Duration of Impact: 6+ weeks investigation and notification, 18+ months legal resolution
Key Takeaways:
- Telecommunications data is extremely valuable for identity theft and social engineering
- Ransom payments may buy temporary reprieve but don't prevent future extortion
- Critical infrastructure breaches require immediate regulatory disclosure