Vendor To Blame for AT&T Data Breach

AT&T has confirmed a data breach but there are yet many unknown details. The telecom giant said it recently learned that three employees of one of its vendors accessed some of its customer accounts without proper authorization. AT&T did not disclose the number of accounts or what information was breached.

"This is completely counter to the way we require our vendors to conduct business," AT&T said in a published statement. "We know our customers count on us and those who support our business to act with integrity and trust, and we take that very seriously. We have taken steps to help prevent this from happening again, notified affected customers, and reported this matter to law enforcement."

An undisclosed number of call records and Social Security Numbers were accessed sometime between April 9 and April 21, AT&T confirmed. The accounts were accessed as "part of an effort to request codes from AT&T that are used to 'unlock' AT&T mobile phones in the secondary mobile phone market," the company said.

Customers can request that phones be unlocked once they have fulfilled their wireless contract. AT&T believes the aim of the breach was to spoof customer identities in order to unlock phones, which are worth more on the secondhand market.

Accounting for Shades of Gray

We caught up with Alberto Solino, a technical program manager at security software and services firm Core Security, to get his take on the breach. He told us this is another example of companies failing to understand the risks that come along with third-party access -- and facing a crisis that may have been prevented by proactively seeking out or understanding potential attack paths.

"You can't make assumptions when it comes to security," Solino said. "You have to find these attack paths and validate them before someone else does or your...

Comments are closed.