Catch up on stories from the past week (and beyond) at the Slashdot story archive


Forgot your password?

AT&T Breached, Exposes 19,000 Identities 143

mytrip writes to tell us is reporting that a recent attack on AT&T's systems saw thousands of customers' personal data compromised. About 19,000 customers of AT&T's online store who purchased equipment for a DSL connection were affected. From the article: "AT&T is offering to pay for credit monitoring services for customers whose accounts have been impacted because they could be at risk of identity fraud. The company also has made available a toll-free number to affected customers to call for more information."
This discussion has been archived. No new comments can be posted.

AT&T Breached, Exposes 19,000 Identities

Comments Filter:
  • ...for using AT&T.
  • O RLY? (Score:5, Insightful)

    by abscissa ( 136568 ) on Wednesday August 30, 2006 @05:27AM (#16005915)
    They will pay for credit monitoring services, but will they pay for all the liability from a stolen ID? That can reach into the hundreds of thousands of dollars in real damage.
    • Heck, frankly... (Score:3, Interesting)

      by skids ( 119237 )
      I wouldn't even be so sure of that. Nowadays whenever I see any corporation saying they take responsibility for something, I immediately suspect another yesmen [] prank.

      Now that may not be very likely, but if I were the yesmen, I'd be perched and waiting for another ID theft scandal, because nothing would be more meta than stealing the ID of a PR person handling an ID theft incident.
    • Re: (Score:1, Flamebait)

      by bsartist ( 550317 )

      They will pay for credit monitoring services, but will they pay for all the liability from a stolen ID?

      It wasn't stolen, it was "shared". Making a copy doesn't take anything away from the original owners, right? They still have their names, social security numbers, etc.

      That can reach into the hundreds of thousands of dollars in real damage.

      A few days ago you said "copying a CD is not a crime". Make up your mind. If information wants to be free, copyright should be abolished, etc., then the same princi

      • Re:O RLY? (Score:4, Insightful)

        by TIMxPx ( 859220 ) on Wednesday August 30, 2006 @07:37AM (#16006251)
        Good point. I suppose that a person releasing 1 million copies of a CD should expect the same level of privacy as a person who submits encrypted credit card information. Oh wait, maybe not.
        • Sort of like when a CD is encrypted so it can't be copied and someone breaks that encryption then releases a million copies of the song. Pretty much apples and oranges.

          Oh wait, maybe not.
          • by blugu64 ( 633729 )
            Heh, good luck with that encrypted audio cd ;) (hint they are not encrypted)

            two people are not breaking into the record companies computers to get the music.
            • by Duhavid ( 677874 )
              Actually, they are encrypted. Play them backwards to get the "plaintext".

              Pretty subtle, eh?
      • Re: (Score:2, Insightful)

        by Anonymous Coward
        > It wasn't stolen, it was "shared". Making a copy doesn't take anything away from the original owners, right? They still have their names, social security numbers, etc.

        It wasn't shared (that implies willingness). If anything, it was "exposed", because it was suposed to be secret or confidential information, something a Britney Spears CD is not (but I would not arge with you if it should).
      • I'm not going to get into the whole copying a CD is not a crime, I don't do it, I don't want the legal ramifications if busted file sharing, but, I don't think that Metallica went bankrupt becuase some kids were downloading MP3's off napster. I am pretty sure, however, that if someone's identity is stolen, it could cause them to loose everything (mortgage forclosures, auto repossesions, having your bank account wiped out these things are very damaging). The data on a music CD is far from sensitive. Befor
      • by Qzukk ( 229616 )
        the same principle applies just as much to your information as it does to a CD. Either "sharing" is OK, or it's not

        Wake me up when downloading a track from emule gets thousands of dollars in creditcard debt taken out in the artist's name by kids on IRC, illegal immigrants getting forged licenses with the label president's drivers license number or getting a job using their SSN, or terrorists buying an internet connection in their name and using it to plan their next bombing run.

        Until then, your attempt to c
      • I know you mean this as a joke, so this isn't directed at the poster really. Still I have to worry that some people might actually believe what you just wrote there. The only thing on a SS-card or a credit card might be the artwork, everything else has no copyright.

        And the fact that these people had their ID stolen is extremely sad. Everytime I get an ad in the mail from my bank wanting me to buy id-theift protection I want to call them and ask about racketeering... Have these people zero liability when

        • Re: (Score:3, Insightful)

          by bsartist ( 550317 )

          The only thing on a SS-card or a credit card might be the artwork, everything else has no copyright.

          I used the term "principle" for a reason. The principle I'm referring to is control. The legal technicalities are different - which is why I specifically did not refer to them. But the principle is the same: the right of a person to control and/or limit the distribution of specific bits of information. To demand that right for one's self while at the same time trying to deny it to others is hypocrisy, plain

      • Re:O RLY? (Score:5, Insightful)

        by jackbird ( 721605 ) on Wednesday August 30, 2006 @08:58AM (#16006603)
        It wasn't stolen, it was "shared". Making a copy doesn't take anything away from the original owners, right? They still have their names, social security numbers, etc.

        That's true. And if the identity thieves stop there, simply filing their collection of stolen identities away and displaying a few choice specimens above the mantle for when guests come over, I don't have a problem with it (well a small one, but I can deal).

        When the identity thieves use those stolen identities to clean out bank accounts, take out fradulent loans, and steal real, physical goods using credit cards in the victim's name, then they do take something the owner no longer has. IHBT. HAND.

      • by jZnat ( 793348 ) *
        I think a better comparison would be somebody leaking a high-quality pre-release of a movie.
      • by orasio ( 188021 )
        You are wrong.
        Copyright is about restricting the freedom of the user of the stuff.

        The distributor performs the service of giving you the information, and you pay for it. End of story, no agreement, no contract.
        Then, there is a law that says that your freedom to distribute the information you paid to access is restricted. You have to wait a lot of time, virtually forever, and then you can share it anyway you like.

        About private information, you enter an agreement with someone to share it with them, and they h
        • Copyright is about restricting the freedom of the user of the stuff.

          No, it's more about protecting the freedom and interests of whoever made a work of art, which is its intention.
          • by orasio ( 188021 )
            - Copyright is about restricting the freedom of the user of the stuff.

            No, it's more about protecting the freedom and interests of whoever made a work of art, which is its intention.

            It's about protecting the interests of the original distributor, at the expense of restricting the users freedom, if you want to say it that way.

            The original intent was about the authors, right now it's more tailored to the needs of distribution companies rather than creators themselves, at least in most countries. For examp
            • That's fair enough, and I personally believe in just a life copyright term, with things becoming public domain on the author's death.
      • Re: (Score:2, Insightful)

        by Evro ( 18923 )
        I imagine if someone was copying the information simply to have it, it wouldn't be a big deal. But the fact is that they're copying it for the purposes of identity theft, which translates to real dollars-and-cents costs for the victims. Copying a CD is not the same thing as copying someone's credit card number, which implies using that number to purchase goods with the stolen information. Your argument is cute but specious.
      • by phorm ( 591458 )
        Seriously, that is disgusting. The article is completely unrelated to filesharing, and focusses on poor security. It also overlooks that the "information wants to be free" zealot crowd aren't necessarily the same as those in the information-security crowd. Either crowd also tends to be happy when somebody is nailed for trying to sell copied articles.

        Copyright won't protect your personal information in any way. So perhaps you should go troll an RIAA article now. Perhaps if there's an article about how a fi
        • It also overlooks that the "information wants to be free" zealot crowd aren't necessarily the same

          What crowd? The "copying a CD is not a crime" quote was exactly that - a direct copy-and-paste quote from an earlier post made by the person I replied to. I wasn't referring to any mythical "crowd", I was referring to two contradictory (IMHO) statements that were made by the same person.

          You might also want to look up the definition of the term "troll" - it doesn't mean what you think it means. It isn't anyo

          • a direct copy-and-paste quote from an earlier post made by the person I replied to

            An early post not related to the article-at-hand.

            Aside from that, you're talking about the 'rights of others' in reference to corporate ip holders, which insinuates that corporations are entitled to the same rights as private individuals.

            But if you want to go back over old different-topic comments made... perhaps I can browse all recent flameish and offtopic moderations you've accumulated recently:

            Offtopic []
            Flamebait []
    • by fyndor ( 895340 )
      Probably not, but it seems like they are going farther than most companies, which in the past notifying the customer seems like the extent a company was willing to go with this kind of blunder. Not that I'm praising them. Companies holding my personal information need to be more secure. But I think this is atleast a step in the right direction. This kind of thing is happening WAY too much lately. WTF
    • One wonders who owns all these "credit monitoring services" getting all this humongous business lately???? Oh, could it possibly be the same companies which are giving it to them and then doing the tax write-offs?????

      [America is 100% corrupt - anyone who does not know this is ignorant - but there is a cure for ignorance - it's called knowledge and awareness.]

  • by Anonymous Coward on Wednesday August 30, 2006 @05:27AM (#16005919)
    I choose to be an Anonymous Coward.
  • Only "thousands"? (Score:5, Interesting)

    by KiloByte ( 825081 ) on Wednesday August 30, 2006 @05:29AM (#16005927)
    thousands of customer's
    Wait, so an one-time spill of the data of just mere thousands of customers (no "'") are suddenly news, and everyone forgets about ongoing constant spilling of the data of 299 millions? Interesting...
    • by azaroth42 ( 458293 ) on Wednesday August 30, 2006 @06:03AM (#16006024) Homepage

      Will the CTO of AT&T resign like AOL's did over the search history release, which was significantly less damaging than this.

      I'm putting my money on No, personally.

      -- Azaroth
      • by $RANDOMLUSER ( 804576 ) on Wednesday August 30, 2006 @06:45AM (#16006134)
        To you and the GP:
        This was a break-in, not a "spill", which was detected by AT;&T, on the weekend at which time they took very active measures (shutting down the site and contacting credit card companies). Sounds to me like they have some pretty good procedures in place already; you know, the kind of thing a CTO is responsible for.
    • Re: (Score:2, Informative)

      by balsy2001 ( 941953 )
      I am in the military and have had my personal information lost/stolen 3 times in the last 18 months. 1) By bank of american "shipping" backup tapes of my account history and other gov crad holders in the back of somones car, 2) Veterans Affairs laptop, 3) Someone hacking into the DOE. This kind of thing happens all of the time and there aren't any real consequences for anyone in either the public or private sectore. As you all may remember the VA loss affected 26 MILLION people.
  • In other news (Score:2, Insightful)

    by suv4x4 ( 956391 )
    In other news:

    "AT&T infects 19'000 of their customers with AIDS, after a 'breach' of their 'security' yesterday.
    AT&T is offering to pay for free condoms for all affected customers."
    • That is a rediculous analogy. If, somehow, AT&T was protecting someone from AIDS, I'm sure if someone broke in and caused a wide spread infection, our attention would be at the person breaking in. Why doesn't anyone care who stole this information? Just one of them wandering security holes? No, someone broke in and stole it. If someone had stolen diamonds, "AT&T" would be looking for and replacing diamonds. Someone stole information, AT&T is trying to keep it from being used. I'm definitely not
  • Affected is preferred.
    Effected suggests being brought into being. A database security breach that effects 19000 new customers would not only bring the wrath of the accountants at the Security and Exchange Commission, but also suggests a militant AI broken loose in ATT!

    In response to the A/C that suggested we're; you can remember that a comma suggests a contraction of we are.

    God is an Iron; Engish was my most hated and worst subject. I leave a glass of Wry for my fellows, but I had to learn this grammer st

    • "Engish"

    • Re: (Score:1, Funny)

      by Anonymous Coward
      1. "Suggest," not "suggests."
      2. "Who," not "that."
      3. Quotation marks are necessary to indicate the treatment of words as text.
      4. Omission of the ampersand in AT&T's name is neglectful at best.
      5. Use italics, not quotation marks, for book titles; also, the comma is not a substitute for a genitive ending.
      6. Finally, as others have noted, the subject you seek is "English."

      I sympathize with your cause, but the effort above is unacceptable. Shape up or ship out of the Grammar Reich, soldier.

  • Why did ATT keep confidential records on an exposed system in the 1st place, instead of immediately moving the critical data to a behind-the-firewall system?

    Or... did they do that, but the crackers were able to pierce the firewall?

  • by Anonymous Coward on Wednesday August 30, 2006 @06:23AM (#16006076)
    These companies need to stop collecting this information in the first place. There is no need for AT&T to have this at all to do their business. Last I checked they aren't the Social Security department.
    • by Dilpo ( 980613 )
      The article said nothing about ss#'s
      And if you must know these businesses usually keep this stuff on record for more than one reason which includes taxes (incase of an audit) returns (so they can put it back on the original credit card because it would be illegal to transfer the balance to another)
      and believe it or not but some people do actually sign up to have their cc billed automatically everymonth.
    • I went to the dentist recently and they wanted my name, address, phone number, social security number, and driver's license number. Since I wasn't paying my cash, I decided that they would like some kind of contact information in case my check bounced (though I guess that's on the check), but I left the SS # and DL # fields blank, since I couldn't figure out what the hell they needed those for (perhaps if I was using insurance?). I figure I'll encounter the same at the doctor. With all the terrorist paranoi
  • Good for them (Score:5, Insightful)

    by Rogerborg ( 306625 ) on Wednesday August 30, 2006 @06:45AM (#16006133) Homepage
    The news here isn't that some incompetent set up their systems, nor that they were cracked. The news is that they've responded openly and meaningfully, without trying to deny it or play down the scale of what happened. I wouldn't be hurrying to sign up to their service because of it, but it certainly doesn't bias me against them. Honesty and integrity are rare enough qualities in corporations that we should applaud them when they claw their way past the lawyers and PR weasels.
  • by Don_dumb ( 927108 ) on Wednesday August 30, 2006 @06:49AM (#16006141)
    . . . AOL is off the hook.
  • Steal identity? (Score:5, Insightful)

    by homer_s ( 799572 ) on Wednesday August 30, 2006 @06:52AM (#16006146)
    How can anyone steal someone else's identity? Oh, you mean they stole people's social security numbers. That should not be a problem, because as we all know, ss numbers are not meant to be used for identification.

    The real problem is companies and the govt using SS# for identification. At this point, about 50 ppl know my SS# - the librarian, the assistant at my school, the clerk in the bank, etc, etc. - so any of these people can harm if they don't like me for some reason? This is stupid.

    So what next? Some company decides they are going to use FIRSTNAME_LASTNAME as the id and we are all supposed to keep our names a secret? And run around complaining when our 'identity' (FIRSTNAME_LASTNAME) is stolen?

    In many countries, you need a notarised signature to obtain loans, etc. While not foolproof, you can always prove it was not you and it takes more effort to commit fraud.
    • by pcgamez ( 40751 )
      The problem is not that 50 people know your SSN. The issue is that companies still act as if it is a secret identifying number. To a company, if you know a name, address, and SSN, you must be that person. It is simply assumed.
      • Re: (Score:3, Interesting)

        by russ1337 ( 938915 )
        That is why, when they ask for my SSN, i say "I don't have one"... They say "huh? *dumbest look on their face*" and I tell them "I was born overseas and do not have one... and you shouln't need it anyway....."... It usually works. I've nearly always had to pay a higher deposit ('cos they cant check my credit), but its a small price to pay to not give my SSN to the library / power company / phone company / old navy / lunchlady...
        • Just make up a fake one for these purposes. Unless they are paying you, taxing you, or checking on your finances, they don't have any need for it. Certainly not as a customer ID.
    • by Eivind ( 15695 )
      I agree. In Norway we also have a "personal-id-number" which works sort of like a SSN in the states. The main difference being that this is explicitly *not* secret. And *no-one* will assume that you are a certain person just because you happen to know the id-number of that person.

      An id-number works perfectly well for *identifying* a certain person. (the bank, the tax-man, the car-registration-people, the unemployment-office and many more will all recognize that a certain number corresponds to a certain pe

  • by saboola ( 655522 ) on Wednesday August 30, 2006 @07:11AM (#16006194)
    You should not be able to do so much damage with a simple number and some extra data. It is ridiculous that armed with merely this amount of information one could cause so much damage. The system needs to be completely reworked.
    • They need to stop using ssn for primary identification. Take an md5 of the ssn and use it for verification perhaps but using it for id is just silly.
      • No!!!

        1. MD5 is weak/broken. No MD5. Erase it from your vocabulary. Replace it with SHA-256 or better.
        2. How many SSNs are there? At max, 1 billion (assuming they go 000-00-0000 to 999-99-9999). A reverse lookup directory of 1 billion 256-bit hashes would take around 36 gigabytes of disk space (if my math is correct).
        3. If you add salt to it, then the salt becomes a secret key to the routine. Lose that key, and someone can re-create the lookup in a matter of hours (minutes?).

        Really, you want to just create a
  • Their mobile phone division is especially vile, in my experience. []
  • That should be "affected", not "effected". There's a difference.
  • So someone hacks a server and 19,000 new customers are created as a result? HOLY CRAP! YOUR RETARDED!
  • Maybe it was the NSA.

  • With the stupid ads that the cable companies has been running lately, I'm wondering if they hired someone to do this.
  • Is the fact that AT&T, who spends more on network security than the gross national income for a lot of countries was compromised, and confidential information was stolen. It doesn't matter how their multi layered defenses got breached, what does matter is they did get breached. The lesson here is IF they can be breached who can't??
  • Scope Creeps (Score:3, Insightful)

    by Doc Ruby ( 173196 ) on Wednesday August 30, 2006 @09:37AM (#16006831) Homepage Journal
    Corporations should not be allowed to store personal info longer than the duration of the transaction, or transmit it outside the scope of the transaction. AT&T should be prosecuted for liability, including lifetime exposure to ID fraud. AT&T security and policy managers and directors should hold personal liability, piercing the corporate liability veil.

    Then we'd see American corporations rush to rewire their databases to protect customers, instead of protecting their advantages in charging and marketing to us, and the risk that their few bucks benefit will destroy our lives.
    • This all sounds well and good... but the costs of all these upgrades would get passed on to the consumer. The end result would be that nobody would be stealing your identity/datamining your soul, but it wouldn't really matter because 1/3 of the things you use your identity for would no longer be available, and 1/3 of them would no longer be acessible to YOU. Convenience and security are at opposite ends of a sliding scale.
      • They might try to pass their costs to the consumer. But that's a problem with competition in the telco cartels. Which is being solved by tech innovation and legal requirements to force open access to telecom subscriber networks.

        If AT&T was found liable for these exposures to probably 500K subscribers the past few years at $5K each cost for protection, that's $2.5B. They might try to pass the cost on to all their subscribers, but they'd find subscribers dropping and switching to competitors. While it pro
  • by Anonymous Coward
    I'm one of the folks whose information was stolen. I discovered this not by AT&T informing me, but by the phishing attempt I received via email. The email claimed they couldn't access my bank account to pay for my order, and directed me to what appeared to be the ordering site. Since they had the actual order number, I didn't think anything was amiss (other than another company screw up asking me to pay for an order I'd already paid for), and clicked the link.

    I was surprised to be prompted to enter m
    • Um, who the hell is marking this flamebait? AT&T employees? The phishers? I'm really at a loss here. And yes, I realize I'll probably be modded down as "flamebait" or "troll" or something.
  • After the customers got affected then only they offer the monitoring service. So shocking they should add the feature long time ago..
  • there's fire.

    This is small time compared to the egregious breach of privacy experienced by nearly everyone with AT&T's complicity with the NSA's illegal splitting operations in San Francisco and elsewhere. AT&T is at it again time for more anti-trust remedies.

    • Re: (Score:3, Insightful)

      by King_TJ ( 85913 )
      Huh? The responsibility for that illegal operation should rest squarely on the shoulders of the current presidential administration. You can't reasonably expect any company in AT&T's position not to comply with something like that - no matter how evil the request is.

      Ultimately, they're put betweewn "a rock and a hard place" because they have no immediate legal recourse for a demand placed on them from the highest level of government. They're already govt. regulated as it is - and failure to comply wi
      • While I would agree in principle, I feel that the example set by Google begs to differ on how to handle unreasonable requests from the Government. In light of the terms and conditions of service, they are being held accountable for their involvement and/or complicity in this illegal search and seizure method. You'll note that the EFF lawsuit is v. AT&T not v. NSA. We all know there's 'No Such Agency' after all.
  • by kasparov ( 105041 ) * on Wednesday August 30, 2006 @11:48AM (#16007916)
    Hell, they probably could have just *asked* for the information and AT&T would have handed it over...
  • by killermookie ( 708026 ) on Wednesday August 30, 2006 @03:40PM (#16009960) Homepage
    This email contains important information that requires your immediate
    attention. Please do not reply to this e-mail; instead please use the
    telephone number provided below if you wish to contact us.

    You previously placed an order with AT&T for DSL-related equipment
    through the [] Website, at which time you
    provided certain information including your name, address, e-mail
    address, phone number, credit card number and credit card expiration.
    (This information did not include your Social Security Number, Driver's
    License Number, date of birth, or other identifying information.) AT&T
    has learned that a computer containing the information you provided has
    been accessed by an unauthorized person, who may have obtained this
    information about you.

    In addition, AT&T also believes that some customers who purchased
    DSL-related equipment from us through this same website may be receiving
    e-mails that appear to be from AT&T, but actually are being generated by
    an unauthorized third-party (a practice known as "phishing"). These
    e-mails refer to your prior order with AT&T and request that you
    provide additional personal information such as your Social Security
    Number, date of birth, or another credit card number and expiration date.
    Please be advised that these e-mails are not being sent by AT&T and are not
    legitimate. Do not respond to these e-mails or otherwise provide any of your
    personal information in response or at any Website to which the e-mail may
    refer you.
    We sincerely regret that a third party was able to gain improper access
    to your order information and we are working diligently with law enforcement
    and major credit card companies to limit your potential exposure. Although
    your 3-digit credit card verification number (from the back of your card)
    was not stored, and therefore not accessed, we strongly suggest that you
    contact your credit card company directly to report this suspected incident
    and to protect the credit card you used to purchase this equipment from any
    unauthorized activity.

    In addition, we suggest that you contact the fraud departments of any one of
    the three major credit-reporting agencies and let them know you may be a
    potential victim of identity theft. That agency will notify the other two.
    Through that process, a "fraud alert" will automatically be placed in each
    of your three credit reports to notify creditors not to issue new credit in
    your name without gaining your permission. For your convenience, we have
    included contact information for all three credit reporting agencies:

    P.O. Box 740241
    Atlanta GA 30374
    To report fraud: 1-888-766-0008
    Website: []

    P.O. Box 2002
    Allen, TX 75013
    To Report Fraud: 1-888-397-3742
    Website: []

    Post Office Box 6790
    Fullerton, CA 92834
    To Report Fraud: 1-800-680-7289
    Website: []

    Lastly, to provide further security, AT&T is arranging to provide you the
    option of enrolling for one year, at no cost to you, in a credit monitoring
    service specifically designed to notify you of changes to your credit report
    activity in order to detect fraudulent bank or credit card use. The service
    will be provided by one of the major credit reporting agencies. We will
    provide specific information on this option as part of a letter you will
    receive via U.S. Mail in the next few days.

    Again, we regret this unauthorized and unlawful access to your order
    information and are working with law enforcement to pursue those who
    are responsible. We are also reviewing applicable security procedures
    in an effort to prevent an incident like this from recurring. Should yo
    • The sad part is that I dropped AT&T (it was SBC at the time) as my DSL provider and switched to Speakeasy several months ago.

      Althought, switching to Speakeasy was the happy part.
  • AT&T Call Center Operator: Sir, may I ask you why you're choosing to cancel your service with us today?

    Me: Well, let's see, first there was that whole Internet tapping thing.

    AT&T: I'm not sure which Internet tapping situation you're referring to...

    Me: GOOD GOD, THERE'S MORE THAN ONE?! Hold on, let me pull up my blog!

    AT&T: No, sir, I meant I'm not personally aware of any Internet tapping. I assure you that AT&T values your privacy...

    Me: And then you cooperated with the NSA in their illegal do

Nondeterminism means never having to say you are wrong.