AT&T admits massive 70m+ mid-March data dump is real, but claims it's years old

That rumored AT&T dark web customer data dump from mid-March has been confirmed, and it's a whopper: A total of more than 73 million current and former customers are included in the cache, AT&T confirmed over the weekend.

The telco giant said in a press release that the data that appeared in cybercrime forums last month was genuine, and included information on 7.6 million current AT&T customers as well as 65.4 million former users. The largest stolen data trove appears to be from 2019 or earlier based on initial investigations, AT&T said. 

"It is not yet known whether the data in those fields originated from AT&T or one of its vendors," the company noted in its press release. "Currently, AT&T does not have evidence of unauthorized access to its systems resulting in exfiltration of the data set." 

The information included in the dump varies per customer, AT&T said on a support page for the incident, but may include full name, email and mailing address, phone number, SSN, birth date and AT&T account number and passcode, the latter being that four-digit identity verification number you always forget when talking to customer support.

While AT&T is withholding judgment on where the data came from, it appears to align with a massive set of AT&T customer data that was offered for sale on the dark web in 2021. 

Cybercrime gang ShinyHunters claimed in mid-2021 to have data belonging to some 70 million AT&T customers that it was offering for sale for the tidy sum of $1m, according to RestorePrivacy, which viewed the dataset. RestorePrivacy also spoke to members of ShinyHunters, who told them the data belonged to US-based AT&T customers, but wouldn't reveal how they obtained it. 

AT&T denied that the data belonged to it in 2021, and it's not immediately clear whether both sets of data are the same. That said, there are plenty of similarities, both in the volume of records included and the items included in the set. 

AT&T claimed in March that the dataset in question may have been "the same dataset that has been recycled several times" on the forum where it was uploaded, but it's not clear whether that's the case. If it's a different set of actual customer records then that just opens a whole other can of worms. 

We've reached out to AT&T with questions and will update this story if we hear back. ®