What happened?
On 30 March 2024, AT&T confirmed that a dataset covering roughly 73 million current and former customers — names, addresses, birth dates, phone numbers, Social Security numbers, and account details — had been published on a hacking forum. The records dated from 2019 or earlier. Crucially, the company stated the data originated from a vendor’s cloud workspace rather than AT&T’s own systems, and it appeared to be the same trove that had hovered on the darkweb since 2021, when a seller first teased it and AT&T disputed its authenticity.
Quick Answer: In March 2024 a 73M-record AT&T customer dataset (2019-era, including SSNs) resurfaced on a hacking forum; AT attributed it to a vendor’s cloud workspace, resetting 7.6M passcodes — the “Snowflake? No.” question dominated coverage until officials clarified this was the legacy 2019 dataset finally dumped free after three years of disputed sales attempts.
The release’s staging was its own story. In 2021, someone calling themselves “KeepNet” shopped the collection; AT&T said it couldn’t verify the data. The listing died quietly — classic darkweb behavior for a dataset whose sale value expired. Then in March 2024, the entire trove achieved second life: posted for free on a major forum’s leak section, by a well-known data-breach actor, ensuring maximal distribution among criminals who prefer no-cost starters. Free publication converts a stale corporate risk into a current credential-stuffing and identity-theft resource.
What was in the records
Columns reported in the leaked samples mirrored 2019-era CRM exports: name, billing address, email, phone, date of birth, Social Security number, and AT&T account specifics like customer number. That last field matters — account numbers enable SIM-swap pretexts and carrier-port fraud in ways generic PII does not. Security researchers’ spot checks against known-current records found partial matches with former customers, consistent with the 2019 snapshot claim.
- Scale: ~73 million individuals — 7.6M current account holders’ passcodes reset proactively by AT&T.
- Sensitivity: SSNs plus birth dates — direct identity-theft enablement, not just spam fuel.
- Provenance disputed: AT&T’s 2021 response — \”not our systems\” — refined in 2024 to \”vendor cloud workspace\”; source system never publicly named.
- Second-hand markets: free publication seeded every downstream fraud shop that aggregates breaches.
The ransom thread that surfaced later
Buried in the July 2024 DOJ filings was the kicker: before the free publication, a member of the Lapsus$-affiliated scene had extorted AT&T — and the carrier, working with law enforcement, paid roughly $370,000 in cryptocurrency for deletion of the stolen call-and-text records (a related but distinct trove). The revelation reframed the March event: companies now visibly weigh extortion economics as breach response, a posture regulators immediately rebuked. For customers, it confirmed that the published data was the floor, not the ceiling, of what had been taken.
The forensics of an unclaimed dataset
The core mystery — whose copy, which system — remained unresolved because the artifacts leaked, not the access. Attribution through data is guessing: the actor publishing in 2024 acquired the trove through resale channels. AT&T’s vendor-workspace statement moved the source from “unknown” to “third-party ecosystem,” which alters liability conversations, breach-notification math, and the regulatory pathway HHS-style frameworks would demand — while leaving the 73M affected people equally exposed either way.
| Date | Event |
|---|---|
| 2021-08 | Dataset first offered for sale on darkweb forum; AT&T disputes authenticity |
| 2024-03-30 | Full dataset posted free on hacking forum; AT&T confirms 73M records, initiates passcode resets |
| 2024-04-01→ | Coverage clarifies provenance: 2019-era data, vendor cloud workspace, not the concurrent Snowflake campaign |
| 2024-07 | FBI/DOJ disclosures later reveal AT&T reportedly paid ~$370K to delete records in a separate, related extortion attempt |
FAQ
Was this related to the 2024 Snowflake breaches?
No — a coincidence of calendar, not campaign. The Snowflake-related compromises (covered in their own timeline entry) hit enterprise analytics tenants with stolen credentials, extracting current-era data. The March AT&T publication was a 2019 snapshot from a vendor workspace, published free. Investigators and journalists spent days disentangling the two stories because both exploded the same fortnight.
Why publish a 2019 dataset for free in 2024?
Reputation and economics. Free flagship leaks build forum status for data brokers; the trove’s resale value had decayed, so spending it for clout maximizes its final utility. For victims, the cost of the gift: their SSNs remain permanent identifiers that never expire the way passwords do.
What should affected customers do?
Accept the passcode reset AT&T pushed; add port-freeze / extra-PIN protections against SIM-swap; place credit freezes with the three bureaus — SSN breaches make freezing non-optional hygiene; and treat any caller who already knows your account number as a red flag rather than a verification signal. Assume the data is permanently public, because it is.
How to read breach re-appearances
A dataset surfacing years after collection follows a predictable arc: sale attempt fails, value decays, someone publishes free for reputation. Defenders should treat any historical “disputed” breach as a delayed-detonation asset — the 2021 AT&T listing was never resolved, only dormant. Inventory your organization’s disputed incidents; assume claim authenticity rises over time as actors seek juice from stale fruit; and for SSN-grade data, remediation is permanent, not incident-scoped. The 2024 re-appearance pattern has repeated across Yahoo, LinkedIn, and now AT&T — the third act always comes.
The vendor-ecosystem problem, again
Whether the workspace belonged to a contractor, a subprocessor, or a marketing platform, the pattern repeats: enterprise data leaves enterprise controls, and containment commentary fills the gap left by preventive architecture. The AT&T episode’s contribution to the year’s debates was timing — arriving beside the first Snowflake disclosures, it primed regulators and journalists with fresh vocabulary for “your data was in someone else’s cloud” by the time the genuinely Snowflake-borne breaches peaked that summer. For customers, though, the distinction was academic: 73 million identities entered permanent criminal circulation in a single weekend. The lesson for every enterprise watching: your breach surface includes every vendor workspace that ever held a copy of your production data — and copies, unlike systems, don’t get migrated or decommissioned. They just wait.
