Cybersecurity Policy Report, AT&T Seen Facing Regulatory Costs After Data Breach Disclosure, (Apr 2, 2024)
Organizations Mentioned:AT&T
The regulatory consequences that could follow AT&T, Inc.’s disclosure that a data breach exposed personal information of millions of current and former customers are unlikely to be “material” to AT&T’s business but could impose “both financial and operational costs” on the company, according to Blair Levin, policy adviser to New Street Research LLP.
AT&T announced on Saturday that it was investigating how personal information regarding 7.6 million current AT&T account holders and 65.4 million former account holders wound up on a darknet website. AT&T said it had no evidence that its systems were breached but was considering whether a vendor suffered a cyber attack (CPR, April 1).
AT&T offered no additional updates today and did not file a disclosure at the Securities and Exchange Commission. Spokespersons did not respond to a request for comment.
In a research note published today, Mr. Levin noted that AT&T agreed to pay $25 million to settle an FCC investigation into a 2015 data breach that exposed the personal information of 280,000 U.S. customers (CPR, April 13, 2015).
“At that time the FCC found that ‘The failure to reasonably secure customers’ personal information violates a carrier’s duty under Section 222 of the Communications Act, and also constitutes an unjust and unreasonable practice in violation of Section 201 of the Act,’” he recalled.
In addition, around 9 million AT&T customers had their data compromised in March 2023 following an attack on an AT&T vendor, and a cybersecurity firm discovered data from 23 million Americans that were likely AT&T customers in the hands of Romanian cyber criminals in 2022, Mr. Levin said.
Those earlier breaches, like the one disclosed over the weekend, included such sensitive data as Social Security numbers and dates of birth.
“Just as with these incidents, we don’t think the regulatory response to the current breach will be material,” Mr. Levin said, “but we expect a government response that will impose both financial and operational costs.”
News: FederalLegislation DataSecurity DataBreach DataPrivacy