Old AT&T data leak resurfaces with over 43M SSNs now decrypted

Hackers have released a new trove of AT&T customer data, linking Social Security numbers, dates of birth, and phone numbers of over 49 million individuals in a leak that’s rapidly spreading through cybercrime forums. According to cybersecurity analysts this “new” leak is a repackaged version of older AT&T data, now made significantly more dangerous.

The data was first posted to a major Russian hacking forum on May 15, and re-uploaded again on June 3. Researchers at Hackread.com, who analyzed the leak, say it includes full names, email addresses, physical addresses, date of births, and nearly 44 million Social Security numbers all in plain text.

“Each data point poses a risk. Together, they create a complete profile that criminals can weaponize for fraud, impersonation, or identity theft,” the researchers said.

Not from Snowflake

Initial claims by the threat actor linked this data dump to the April 2024 AT&T breach, which was reportedly executed by the ShinyHunters group via vulnerabilities in the Snowflake cloud data platform. However, analysis by cybersecurity experts and AT&T's own investigation suggest otherwise.

The contents of this newly surfaced database do not fully match the details reported in the Snowflake-related AT&T breach, which primarily involved call and text metadata for approximately 110 million customers.

Cybersecurity publication BleepingComputer independently confirmed the data appears to originate from a 2021 breach, also attributed to the ShinyHunters hacking group. At the time, the group attempted to sell the data for $200,000.

AT&T confirmed the findings, saying, “After analysis by our internal teams as well as external data consultants, we are confident this is repackaged data previously released on the dark web in March 2024,” an AT&T spokesperson said. “Affected customers were notified at that time. We have notified law enforcement of this latest development.”

What Should AT&T Customers Do?

Though AT&T says affected users were already notified, experts advise all past and present AT&T customers to:

• Monitor credit reports and bank accounts for suspicious activity

• Consider placing a credit freeze or fraud alert

• Use identity monitoring services

• Be extra vigilant against phishing or SIM-swap scams

While AT&T may have closed the books on this breach years ago, hackers have reopened them, reminding everyone that in the digital age, old data never truly dies.