Cybersecurity Policy Report, AT&T Agrees to $13 Million Penalty to Settle Data Breach Investigation, (Sep 17, 2024)

By Jeff Williams

The FCC announced today that its Enforcement Bureau has reached a settlement with AT&T Services, Inc., calling for the company to pay $13 million to resolve the bureau’s investigation stemming from a 2023 data breach at an unnamed vendor that AT&T used “to generate and host personalized video content for AT&T customers, including billing and marketing videos,” according to the consent decree.

In addition to the civil monetary penalty, AT&T committed in a consent decree to strengthen its data governance practices “to increase its supply chain integrity and ensure appropriate processes and procedures are incorporated into AT&T’s business practices in the handling of sensitive data to protect consumers against the harmful effects of similar vendor data breaches in the future,” the FCC said in a news release.

The data breach “occurred when threat actors accessed the vendor’s cloud environment and ultimately exfiltrated AT&T customer information that the Company had previously shared with the vendor. The vendor should have destroyed or returned that customer information years prior to the 2023 Breach pursuant to relevant contracts AT&T entered into with the vendor,” the bureau said in an order adopting the consent decree, FCC, Order in the Matter of AT&T Services, Inc., File EB-TCD-23-00034851 (Sept. 16, 2024).

Regarding today’s settlement, AT&T said in a statement, “Protecting our customers’ data remains one of our top priorities. A vendor we previously used experienced a security incident last year that exposed data pertaining to some of our wireless customers. Though our systems were not compromised in this incident, we’re making enhancements to how we manage customer information internally, as well as implementing new requirements on our vendors’ data management practices.”

AT&T also noted that “[c]onsistent with FCC requirements, we began notifying customers of this incident in March 2023” and that the breach “included information like the number of lines on an account. It did not contain credit card information, Social Security Numbers, account passwords or other sensitive personal information.”

FCC Chairwoman Jessica Rosenworcel said in a news release, “The Communications Act makes clear that carriers have a duty to protect the privacy and security of consumer data, and that responsibility takes on new meaning for digital age data breaches. Carriers must take additional precautions given their access to sensitive information, and we will remain vigilant in ensuring that’s the case no matter which provider a customer chooses.”

Under AT&T’s contracts, the bureau said in its order that the vendor “should have destroyed or returned AT&T customer information when no longer necessary to fulfill contractual obligations, which ended years before the breach occurred,” FCC, Order In the Matter of AT&T Services, Inc., File EB-TCD-23-00034851 (Sept. 17, 2024).

It said AT&T “failed to ensure its vendor adequately protected that customer information; instead, it remained in the vendor’s cloud environment for many years after it should have been deleted or returned to AT&T and was ultimately exposed” in the breach.

The security improvements AT&T agreed to include, among other things, enhancing “tracking of customer data as part of a data inventory program,” requiring its vendors to “adhere to retention and disposal obligations,” implementing “multifaceted vendor controls and oversight” and a “comprehensive Information Security Program to include broad customer data protections,” as well as conducting annual compliance audits, the FCC said.

Implementing the consent decree provisions “will require AT&T to make significant investments in and prioritize the safeguarding of customers’ information shared with third parties,” the FCC said. “Given AT&T’s size, number of customers, and extensive use of vendors, this will likely require expenditures far greater than the civil penalty herein. The Commission will hold AT&T accountable for making these mandatory changes to its data protection practices as required to comply with this Consent Decree and the Communications Act going forward.”

News: FederalLegislation LitigationEnforcement DataBreach DataSecurity