AT&T Call and Text Records for Nearly All Customers Stolen from Snowflake Workspace
In a 12 July 2024 SEC 8-K, AT&T disclosed that attackers copied call and text records of nearly all its wireless customers (about 109–110 million) from May–October 2022 and 2 January 2023, taken from its workspace on a third-party cloud platform later identified as Snowflake.
02Deep-Dive Technical Analysis
Between 14 and 25 April 2024, attackers used credentials without multi-factor authentication, part of the wider UNC5537 campaign that used infostealer-harvested logins against about 165 Snowflake customers, to export AT&T analytics data. The files held phone numbers that subscribers called or texted, interaction counts, aggregate call durations and, for a subset, cell-site identifiers that can approximate location; no call content or names were included. The US DOJ twice approved delaying disclosure on national-security grounds. Prosecutors later charged Connor Moucka and John Binns; reports say AT&T paid about $370,000 to have the data deleted.
03Vulnerability & Exploit Flow
Reuse of stolen credentials against a cloud data-warehouse account lacking multi-factor authentication.
04Recommended Defense & Mitigation Protocol
Mandatory MFA and network allow-listing for cloud data platforms, credential rotation, and minimizing CDR copies outside the core.
05Security Impact & Geopolitical Consequence
Showed that bulk CDR metadata copied to cloud analytics platforms can map social networks and approximate locations at national scale, intensifying calls for mandatory MFA and tighter telecom data-retention controls.
06Authoritative Standards & External References
07Related Topic Cluster Records
Master 5G Core, SS7 Defense & Subsea Cable Auditing
Ready to turn your historical knowledge into certified hands-on expertise? Register free on TelcoSec Academy to access interactive lab challenges, or consult our enterprise team for carrier-grade signaling assessments and portable BTS hardware.