Cybersecurity Policy Report, Sens. Blumenthal, Hawley Decry AT&T Data Breach, Demand Answers, (Jul 16, 2024)
Organizations Mentioned:AT&T | Advance Auto Parts | Santander Bank
A data breach that exposed information from “nearly all” of AT&T, Inc.’s cellular customers was a “stunning and dangerous breach of its customers’ privacy” that should have been prevented, according to Sens. Richard Blumenthal (D., Conn.), chair of the Senate Judiciary Committee’s privacy, technology, and the law subcommittee, and Josh Hawley (R., Mo.), the subcommittee’s ranking member.
Sens. Blumenthal and Hawley today wrote to AT&T Chief Executive Officer John Stankey and Sridhar Ramaswamy, CEO of Snowflake, Inc., an AT&T cloud service partner, to seek more information about the breach.
AT&T disclosed the breach last Friday and reported that the stolen data included call records but not the contents of communications or personal information such as Social Security numbers or dates of birth (CPR, July 12). AT&T said the data was taken from a third-party cloud business partner, which the senators identified as Snowflake.
“We write demanding information regarding the breach of AT&T’s private customer data and seek answers about how AT&T failed to protect such profoundly sensitive information from cybercriminals,” the senators said in their letter to Mr. Stankey.
“The theft of AT&T subscriber information appears to be connected with an ongoing series of breaches of clients of Snowflake, a cloud service designed to help companies analyze business data,” they noted.
“In addition to AT&T, other companies including Ticketmaster, Advance Auto Parts, and Santander Bank, have announced breaches of customer or employee information hosted on their Snowflake services. While AT&T is the latest Snowflake customer to disclose a breach, according to the cybersecurity firm Mandiant, 160 other organizations also appear to have been targeted in the hacking campaign,” they said.
“Disturbingly, the AT&T breach appears to have been easily preventable. While Snowflake, AT&T, and other clients have avoided taking direct responsibility, according to Mandiant, it appears that the cybercrime group behind the breaches obtained companies’ passwords from malware infections, including malware bundled with pirated software,” the senators wrote.
“Compounding this basic cybersecurity failure, the hacked accounts had often kept the same passwords for several years, failed to implement firewall access, and failed to turn on multi-factor authentication—additional basic cybersecurity failures that seemingly reflect gross negligence, particularly in light of the sensitivity of the data stolen in many of the breaches,” they added.
They asked Mr. Stankey to provide additional information about the breach by July 29, including the reasons for AT&T’s delayed public disclosure.
In their letter to Mr. Ramaswamy, they set a July 29 deadline for the company to explain, among other things, how it was addressing the various breaches associated with its cloud service.
News: DataSecurity FederalLegislation DataBreach