Dive Brief:

• A cyberattack targeting AT&T’s Snowflake environment compromised data on nearly all of the telecom provider’s wireless customers, the company said in a Friday filing with the Securities and Exchange Commission. Nearly 110 million customers are impacted, according to AT&T’s annual report for the period of compromised data.
• Data stolen during the intrusion includes records of AT&T customers’ calls and text messages spanning a six-month period ending Oct. 31, 2022, and records from Jan. 2, 2023, the company said in the SEC filing. 
• The attack did not expose the content of calls or text messages, customer names or personally identifiable information, according to AT&T. Yet, the stolen records include the phone numbers AT&T wireless customers interacted with, counts of those interactions and aggregate call duration for a day or month.

Dive Insight:

AT&T is one of at least 100 companies impacted by a wave of attacks targeting Snowflake customer environments. AT&T spokesperson Andrea Huguely told Cybersecurity Dive the customer data was stolen from the carrier’s Snowflake database.

The attacks targeting Snowflake customers were not caused by a vulnerability, misconfiguration or breach of Snowflake’s systems, Mandiant said last month in a threat intelligence report.

Stolen credentials obtained from multiple infostealer malware infections on non-Snowflake owned systems were the point of entry for the attacks, Mandiant said. Impacted customer accounts were not configured with multifactor authentication.

AT&T said it became aware of the attack and theft of AT&T call logs on April 19, and immediately activated its incident response process with the aid of third-party cybersecurity experts.

Attackers accessed AT&T’s Snowflake environment between April 14 and April 25, the wireless network provider said.

“AT&T has taken additional cybersecurity measures in response to this incident including closing off the point of unlawful access,” the company said in the SEC filing. “AT&T will provide notice to its current and former impacted customers.”

The telecom giant delayed filing a cybersecurity incident disclosure with the SEC after the FBI and Justice Department granted delays on May 9 and June 5 due to potential risks to national security and public safety, according to the SEC filing. The FBI fields and investigates disclosure delay requests before referring decisions to the DOJ.

“AT&T, FBI, and DOJ worked collaboratively through the first and second delay process, all while sharing key threat intelligence to bolster FBI investigative equities and to assist AT&T’s incident response work,” a spokesperson for the FBI said via email.

AT&T said it’s working with law enforcement in an ongoing investigation. “Based on information available to AT&T, it understands that at least one person has been apprehended,” the company said in the SEC filing. “As of the date of the filing, AT&T does not believe that the data is publicly available.”