Millions of AT&T customers saw their data, including sensitive information, published online late last week. The leak appears to be linked to a data breach from 2021, which AT&T denied at the time.
The leak first came to light in 2021, when it was hackers claimed they’d stolen customer data from AT&T and said they were putting the information up for sale. Pieces of a set of data, purportedly from AT&T, were then published, but no breach was ever specifically verified. To boot, AT&T outright denied that this leak even took place.
The news returned to the surface when the full set of that same stolen data was alleged to have been leaked late last week. The newly leaked data set included sensitive information such as Social Security numbers, home addresses and names. Troy Hunt, creator of Have I Been Pwned?, a website that allows you to see if you were involved in a breach and what data was compromised, analyzed the leaked data in a blog post.
Hunt’s post explains the technical aspects of the leak, but doesn’t draw a conclusion about where the data came from or who stole it. One thing is clear, though: Hunt feels that he has “proven, with sufficient confidence, that the data is real and the impact is significant.”
Ultimately, it doesn’t matter where the leaked information came from. If your personal information is out there for everyone to see, you’re going to want to do something about it. We’ve rounded up what you need to know about the alleged AT&T breach and what next steps you can to take if you find your information has been exposed.
For more, here’s our picks for the best identity theft protection and monitoring services and how Consumer Report’s permission slip can help you take control of your online data.
AT&T did not immediately respond to CNET’s request for comment.
What to know about the alleged AT&T data breach
AT&T denied that this breach came from the cell phone provider in 2021, when it was initially reported, and then again in 2024 when the full set of potentially stolen data was posted online. This means we aren’t entirely sure where this data came from , but according to TechCrunch, reports from customers who’ve identified their own data indicate that this data could be authentic.
The data in the leak contains names, personal addresses, email addresses, phone numbers, dates of birth and social security numbers.
The alleged breach includes the personal information of up to 73 million AT&T customers. It’s possible that some of this data is repeated, however, so the actual number of affected customers could be lower than that.
How to find out if your information is involved in the leak
As of publishing, AT&T has not provided customers a way to see if their data was involved in the alleged breach. Granted, the company has continuously denied that this breach came from AT&T in the first place.
That doesn’t mean that there aren’t things you can do to help yourself out. As mentioned above, Have I Been Pwned is an easy to way to see whether or not your data has been leaked. Users on the r/privacy subreddit recommend keeping an eye out for any news regarding a breach you might’ve been involved in.
How to monitor your credit report for fraud
If you were affected by the alleged leak, or you are simply worried that you were affected, then it’s not a bad idea to keep an eye on your credit reports for any potential fraud.
Monitor your credit reports. You get one free credit report a year from the three major credit bureaus: Equifax, Experian and TransUnion. (Note that Equifax is recovering from its own data breach.) On your report, look for unusual or unfamiliar activity, such as the appearance of new accounts you didn’t open. And watch your credit card accounts and bank statements for unexpected charges and payments.
Sign up for a credit monitoring service. Pick a credit monitoring service that constantly monitors your credit report on major credit bureaus and alerts when it detects unusual activity. To help with the monitoring, you can set fraud alerts that notify you if someone is trying to use your identity to create credit. A credit-reporting service like LifeLock can cost $10 to $30 a month — or you could use a free service like the one from Credit Karma.
Watch this: Finding our personal data on the dark web was far too easy
What to do if you suspect you’re a victim of fraud or identity theft
As soon as you suspect your ID has been stolen you can take action to unauthorized stop charges and start to recover your identity.
Place a fraud alert. If you suspect fraud, place a fraud alert with each of the credit reporting companies: Equifax, Experian and TransUnion. The alert notifies creditors that you have been a victim of fraud and lets them know to verify that you’re making new credit requests in your name. You can place an initial fraud alert, which stays on your credit report for 90 days, or an extended fraud alert, which stays on your credit report for seven years. Placing a fraud alert won’t affect your credit score.
Contact fraud departments. For each business and credit card company where you think an account was opened or charged without your knowledge, contact its fraud department. While you’re not responsible for fraudulent charges to an account, you need to report the suspicious activity promptly.
Freeze your credit. If you want to stop anyone from opening credit and requesting loans and services in your name without your permission, you can freeze your credit. You will need to request a freeze with each of the three credit reporting companies, which again are Equifax, Experian and TransUnion. To apply for new credit, you need to unfreeze your credit, again, through each of the credit reporting companies. You can either request a temporary lift of the freeze or unfreeze it permanently.
Document everything. Keep copies of all documents and expenses and records of your conversations about the theft.
Create a recovery plan. The Federal Trade Commission has a valuable tool that helps you report identity theft and recover your identity through a personal recovery plan.
