AT&T Reveals Massive Hack With Nearly All Wireless Customers Impacted

AT&T said Friday that hackers had accessed call and text interactions of nearly all of its customers last spring in a massive hack of the telecom giant. Cybersecurity expert Richard Stiennon, founder of IT-Harvest and publisher of the Security Yearbook, provides details in this interview.
AT&T said in an SEC filing it learned in April "that a threat actor claimed to have unlawfully accessed and copied AT&T call logs." The company immediately activated its incident response process to investigate and retained external cybersecurity experts to assist. Based on its investigation, it believes that "threat actors" unlawfully accessed an AT&T workspace on a third-party cloud platform and, between April 14 and April 25, 2024, exfiltrated files containing AT&T records of customer call and text interactions that occurred between approximately May 1 and October 31 of 2022, as well as on January 2, 2023.
Stiennon also announced the addition of NIST controls to the 10,666 cybersecurity products IT-Harvesst catalogs. The new NIST update includes all five functions (Identify, Protect, Detect, Respond, Recover) and the 23 main categories that fall under these functions. In total, we have 15,030 mappings from products to individual NIST categories, all of which can be searched through a new dedicated filter. We have mappings for ~7,100 products (with more being added in on-going updates to