AT&T Fined $25M for Offshore Customer Data Leak
AT&T will pay a $25 million fine after regulators held it responsible for thieves taking personal details of 280,000 customers. The breaches were said to have occurred around November 2013 and April 2014, with the FCC beginning its investigation around May of 2014. It's the biggest ever such fine in the communications industry.
The stolen information included the customers' names, part or all of their social security numbers, and some details about their account. On its own, the data wouldn't be enough for criminals to immediately steal money from customer's bank accounts, but could make identity theft significantly easier.
The thefts took place at call centers based in Mexico, Colombia and the Philippines. AT&T says it will stop doing business with those call centers, but hasn't yet confirmed the precise timetable for when it will do so. (Source: wsj.com)
Call Center Staff Bribed To Leak Data
This wasn't a case of hacking or physically stealing stored data. Instead, call center staff were paid to look up and pass on customer details. There's no word yet on how much the staff were paid or how this compared with the wages they received from their employers.
It seems the goal of the data theft was to make it easier to unlock phones, meaning they could run on any cellular network, even though they were supposed to be 'locked' to AT&T as a condition of the network subsidizing the original handset purchase. Having the customer name and the last four digits of the social security number would be enough to make an online request to unlock the phone.
The most likely explanation is that the people who paid for the stolen data wanted to make it easier to resell stolen phones. It's not yet clear if they had already stolen the phones and wanted the details, or if they planned to build up a massive database of stolen details ready to check when they got hold of a phone.
Customers Get Credit Monitoring As Compensation
As part of its investigation, the FCC discovered that the call center staff who'd taken the bribes would also have had access to customer call records, including the times and duration of calls and the number dialed. However, it doesn't appear the staff passed on any of those details.
The FCC concluded that even though the breach took place at a third-party call center, AT&T didn't do enough to make sure such a data theft didn't happen. "As the nation's expert agency on communications networks, the commission cannot -- and will not -- stand idly by when a carrier's lax data security practices expose the personal information of hundreds of thousands of the most vulnerable Americans to identity theft and fraud," noted FCC Chairman Tom Wheeler.
AT&T now has 30 days to pay the fine. It will also have to contact all the affected customers, inform them of the breach, and offer to pay for credit monitoring services. (Source: cnet.com)
What's Your Opinion?
Is $25 million a fair and sufficient penalty given the circumstances? Could firms do more to make sure third party call centers, including those based overseas, reduce the risk of staff stealing data? Or should tech firms keep all call centers and data handling in-house?
Most popular articles
- Which Processor is Better: Intel or AMD? - Explained
- How to Prevent Ransomware in 2018 - 10 Steps
- 5 Best Anti Ransomware Software Free
- How to Fix: Computer / Network Infected with Ransomware (10 Steps)
- How to Fix: Your Computer is Infected, Call This Number (Scam)
- Scammed by Informatico Experts? Here's What to Do
- Scammed by Smart PC Experts? Here's What to Do
- Scammed by Right PC Experts? Here's What to Do
- Scammed by PC / Web Network Experts? Here's What to Do
- How to Fix: Windows Update Won't Update
- Explained: Do I need a VPN? Are VPNs Safe for Online Banking?
- Explained: VPN vs Proxy; What's the Difference?
- Explained: Difference Between VPN Server and VPN (Service)
- Forgot Password? How to: Reset Any Password: Windows Vista, 7, 8, 10
- How to: Use a Firewall to Block Full Screen Ads on Android
- Explained: Absolute Best way to Limit Data on Android
- Explained: Difference Between Dark Web, Deep Net, Darknet and More
- Explained: If I Reset Windows 10 will it Remove Malware?
![](/graphics/dennisfaas.jpg)
My name is Dennis Faas and I am a senior systems administrator and IT technical analyst specializing in cyber crimes (sextortion / blackmail / tech support scams) with over 20 years experience; I also run this website! If you need technical assistance , I can help. Click here to email me now; optionally, you can review my resume here. You can also read how I can fix your computer over the Internet (also includes user reviews).
We are BBB Accredited
![](https://www.infopackets.com/graphics/bbb.png)
We are BBB accredited (A+ rating), celebrating 21 years of excellence! Click to view our rating on the BBB.