AT&T reportedly paid £307k to hacking firm to delete stolen data
Written by Finbarr Toesland Thu 18 Jul 2024
US telecoms firm AT&T is alleged to have paid hackers £307,750 ($400,000) to delete all user data stolen in a cyberattack.
A hacker who is believed to be a member of high-profile ShinyHunters hacking group told WIRED that a ransom payment was made in Bitcoin. Blockchain security business, Chainalysis, investigated the claims and found a transaction to a Bitcoin wallet that matches the ransom timeline.
The cyberattack occurred from 14 and 15 April, with calling and text message records from over 100 million people impacted. While AT&T have said the content of calls and messages were not stolen, including sensitive personal information, there are fears data from the breach could be used to target victims through social engineering.
In the SEC filing, AT&T said the hacked data showed periods of time, records of calls and texts of nearly all of AT&T’s wireless users and users of mobile virtual network operators using AT&T’s wireless network.
“These records identify the telephone numbers with which an AT&T or MVNO wireless number interacted during these periods, including telephone numbers of AT&T wireline users and users of other carriers, counts of those interactions, and aggregate call duration for a day or month,” added the filing.
The cyberattack successfully exploited the Snowflake cloud storage account weakness, which also saw more than 150 companies, including Ticketmaster and Santander, becoming compromised.
According to reports, the hacking firm first asked for £769,000 ($1 million) but AT&T were able to negotiate the ransom down to around a third of this figure. Due to the massive nature of the hack, which is believed to be one of the largest in the history of the US, the US Department of Justice gave the telecoms firm permission to delay public notification of the breach.
Written by Finbarr Toesland Thu 18 Jul 2024
Most Viewed News
Fri 2 Oct 2026
AI skills gap grows despite 64% of workers using AI