AT&T data breach: what happened and what to do
In March 2024 a data set allegedly from AT&T, dated to August 2021 by Have I Been Pwned, was posted online. It lists 49,102,176 accounts with names, phone numbers, email and home addresses, dates of birth and government ID numbers.
View all 13,115 breaches- Breach date
- 20 Aug 2021
- Affected
- 49,102,176
- Data exposed
- Dates of birth, Email addresses, Government issued IDs, Names, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In March 2024, a large file of customer records allegedly taken from AT&T was posted online. Have I Been Pwned (HIBP), the breach notification service run by Troy Hunt, loaded it on 19 March 2024 and lists 49,102,176 affected accounts. HIBP dates the underlying breach to 20 August 2021.
The date matters. A seller had already offered an AT&T customer database for sale in 2021. AT&T said at the time that the data didn't come from its systems. When the same kind of data was released for free in March 2024, AT&T confirmed that the fields in it were specific to AT&T. The company said the information appeared to be from 2019 or earlier, and reporting at the time did not establish how it had been taken.
AT&T's own count of affected people has been reported differently from HIBP's. HIBP counts accounts in the file it received, and the same person can show up more than once.
What was exposed
HIBP lists six types of data: names, phone numbers, email addresses, physical addresses, dates of birth and government issued IDs. In AT&T's statement the government ID was a Social Security number, and some records also carried an AT&T account number and passcode. AT&T said call history and financial information weren't included.
A Social Security number next to a name and a date of birth is the core of a US identity file. It's what a lender checks when someone applies for credit, and it doesn't change. A passcode is different. If you reused it anywhere, change it there too.
What criminals can do with it
The mix of data points to a few specific problems:
- Identity theft. Name, date of birth and Social Security number are enough to open credit accounts or file a false tax return in your name.
- SIM swap and account takeover. A phone number plus an account number and personal details is what someone needs to convince a carrier's support line to move your number to a new SIM. From there they can intercept text message codes for your bank or email.
- Targeted phishing and smishing. A message that knows your name, your carrier and your address looks real. Expect texts and calls claiming to be AT&T, your bank or a "fraud department".
Some of it will be stale. Your Social Security number and date of birth won't be.
The company's response
AT&T denied the 2021 sale and confirmed the 2024 release. It said the data looked like it dated from 2019 or earlier and that it didn't include call history or financial details. For anything about offers or notices, go to AT&T's own site. Don't trust a link in a message.
Where this leaves you
If you were an AT&T customer around 2019, assume your details are in circulation. The practical steps are to freeze your credit, lock down your mobile account against SIM swaps and treat unexpected messages about AT&T with suspicion. Breach data can't be pulled back. So the steps below make it less useful.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
Place a free freeze with Equifax, Experian and TransUnion. A freeze stops new credit being opened with your Social Security number, and you can lift it for a few days when you apply for something yourself.
- 2
Add a PIN or passcode to your mobile account
Ask your carrier to require a PIN before anyone changes your SIM or port-out status. If your old AT&T passcode is used anywhere else, change that too.
- 3
Move 2FA off text messages where you can
Use an authenticator app or a security key for your bank, email and other key accounts, so a hijacked number doesn't open them.
- 4
Treat messages about this breach as suspect
Don't click links in texts or emails about AT&T, your account or 'fraud alerts'. Open the carrier's app or type the address in yourself.
- 5
Watch your statements and credit reports
Check your bank and card statements for charges you don't recognize, and pull your free credit reports from annualcreditreport.com every few months.
- 6
Check whether your email or phone number is in this and other breaches
A free scan from Serus shows which breaches include your email or phone number. Serus monitors breach databases and the dark web and alerts you when your data shows up. It can't remove data from a breach, so the alert tells you what to change.
Frequently asked
Was I affected by the AT&T data breach?
You can look up your email address on Have I Been Pwned. If you had an AT&T account around 2019 or earlier, assume your data may be in the file even if the lookup finds nothing, since the file doesn't hold every customer.
What data was exposed?
HIBP lists names, phone numbers, email addresses, physical addresses, dates of birth and government issued IDs. AT&T said the government ID was a Social Security number for some people, and that call history and financial information weren't included.
Why does the breach date say 2021 if it was reported in 2024?
HIBP dates the underlying breach to 20 August 2021, when a seller first offered the data. The data was added to HIBP on 19 March 2024 after it was posted freely.
Should I change my password?
Change your AT&T account passcode and any account where you used the same one. HIBP doesn't list passwords for this breach, but AT&T said some records carried account passcodes.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
