Full Report
Hackers leak data of 88 million AT&T customers with decrypted SSNs; latest breach raises questions about links to earlier Snowflake-related attack.
Analysis Summary
# Incident Report: Alleged AT&T Customer Data Leak via Snowflake Exploitation
## Executive Summary
In April 2024, threat actors associated with the ShinyHunters group exploited security vulnerabilities in the Snowflake cloud data platform used by AT&T, resulting in the compromise of customer data, including call and text metadata. This incident was followed by the public circulation and subsequent decryption of sensitive customer Personally Identifiable Information (PII), including 44 million Social Security Numbers (SSNs), which were first posted on cybercrime forums in May/June 2025. AT&T initiated an incident response, contained the access point, and notified customers, though the precise scope linking this leaked data to the initially reported April 2024 metadata breach remains partially unconfirmed.
## Incident Details
- **Discovery Date:** May 15, 2025 (First posting on cybercrime forum)
- **Incident Date:** April 2024 (Initial compromise of Snowflake environment)
- **Affected Organization:** AT&T
- **Sector:** Telecommunications
- **Geography:** Not explicitly stated, likely USA based on customer data type (SSNs).
## Timeline of Events
### Initial Access
- **Date/Time:** April 2024 (Duration cited as May 2022 to October 2022 for the underlying Snowflake compromise, but the *specific* AT&T data exfiltration linked to ShinyHunters occurred in April 2024).
- **Vector:** Exploitation of major security flaws in the Snowflake cloud data platform, likely utilizing **stolen credentials lacking Multi-Factor Authentication (MFA)**.
- **Details:** Attackers accessed AT&T's data stored within the Snowflake environment, compromising customer call and text metadata (initially reported).
### Lateral Movement
- *Details regarding internal network lateral movement are not provided; the access appears focused on the cloud data store.*
### Data Exfiltration/Impact
- **Date/Time:** April 2024 (Exfiltration) / May 15 & June 3, 2025 (Data Leaked Publicly)
- **Details:** Data claimed to be from the breach was leaked, containing **86 million unique AT&T customer records**. Crucially, the leaked data included **Full Names, DOBs, Phone Numbers, Email Addresses, Physical Addresses, and 44 Million Social Security Numbers (SSNs)**. The SSNs were confirmed to be **decrypted and in plain text**, contrasting with an earlier, separate data dump where they were encrypted.
### Detection & Response
- **Detection:** The data began circulating on cybercrime forums starting May 15, 2025.
- **Response Actions:** AT&T initiated an incident response process with third-party cybersecurity experts, closed the unauthorized access point, and notified affected customers. AT&T also reportedly paid a ransom of approximately $370,000 in Bitcoin via an intermediary to have the stolen data deleted.
## Attack Methodology
- **Initial Access:** Exploitation of security vulnerabilities in the Snowflake data warehouse environment; utilized stolen credentials lacking MFA.
- **Persistence:** Not detailed, though the data exfiltration occurred significantly after the primary access window was noted in background context (May 2022 - Oct 2022).
- **Privilege Escalation:** Not detailed.
- **Defense Evasion:** Not detailed, implied by undetected access within the Snowflake environment during the initial breach period.
- **Credential Access:** MFA was reportedly missing/not enforced on compromised credentials used to infiltrate Snowflake.
- **Discovery:** Not detailed.
- **Lateral Movement:** Not detailed (Focus was on data store access).
- **Collection:** Gathering of PII fields (Names, DOB, SSN, Address, Contact Info) and metadata (Call/Text records).
- **Exfiltration:** Data was exfiltrated from the Snowflake service during April 2024 and subsequently leaked publicly.
- **Impact:** High-impact PII exposure, including decrypted SSNs, increasing identity theft risk for 86 million customers.
## Impact Assessment
- **Financial:** AT&T paid a ransom of ~$370,000 in BTC. Specific internal investigation and remediation costs are unstated.
- **Data Breach:** Leak of approximately 86 million customer records. Includes Full Names, DOB, Phone, Email, Physical Addresses, and **44 million SSNs (in plain text)**.
- **Operational:** The primary breach occurred in 2024; the public leak in 2025 spurred political scrutiny (lawmakers demanding answers).
- **Reputational:** Significant reputational damage given AT&T’s history of breaches and the severity (plain text SSNs) of the exposed data.
## Indicators of Compromise
*Note: Specific IOCs are often withheld in public reports; the following are behavioral/contextual indicators related to the data itself.*
- **Network indicators:** Traffic associated with access to AT&T data within the Snowflake environment (Timeframe: April 2024).
- **File indicators:** Three well-structured CSV files containing customer data matching historical AT&T breach records, featuring decrypted SSNs.
- **Behavioral indicators:** Posting of large structured datasets purportedly belonging to AT&T on Telegram and Russian cybercrime forums (starting May 15, 2025).
## Response Actions
- **Containment:** Threat actors’ unauthorized access point was closed.
- **Eradication:** Not detailed, but implied cleanup related to the access vector.
- **Recovery actions:** AT&T initiated an incident response process utilizing third-party cybersecurity experts and notified affected customers. A ransom payment was facilitated to attempt data deletion.
## Lessons Learned
- **Cloud Security Posture:** The incident highlights the critical risk associated with inadequate security controls (like missing MFA) protecting highly sensitive data in third-party cloud data warehouses like Snowflake.
- **Data Sensitivity/Decryption:** Encryption status is not a guarantee during a breach; data can be decrypted post-exfiltration, rendering previously 'safe' encrypted data extremely toxic upon public release.
- **Data Proliferation:** Paying a ransom does not guarantee data deletion; the data continued to circulate and was later enhanced (decrypted) and re-leaked.
## Recommendations
- **Mandatory MFA:** Immediately enforce Multi-Factor Authentication across all accounts accessing cloud data platforms (e.g., Snowflake) and all administrative interfaces.
- **Data Segmentation/Minimal Access:** Review data stored in the Snowflake environment to ensure only absolutely necessary PII (especially SSNs) is stored, or ensure stronger encryption controls mandated per organizational policy.
- **Verify Ransom Effectiveness:** Reassess business policies regarding ransom payments, as this payment did not prevent the re-leak or modification/enhancement (decryption) of the sensitive data.
- **Enhanced Monitoring:** Increase logging and anomaly detection capabilities specifically targeting unusual data extraction patterns from cloud data stores.