Personal Data Stolen Years Ago Published Online

Three years after an alleged data breach of AT&T customers, the full dataset is now available online.

In 2021, a threat actor, known as ShinyHunters, put a dataset of more than 70 million users up for auction, claiming it was data from AT&T users. The starting price was set to $200,000, with incremental increases of $30,000. ShinyHunters was allegedly willing to sell immediately for $1 million. Now, three years later, the full dataset is publicly available.

AT&T has remained steadfast in its position that it has no evidence of a data breach of its systems. When also asked in 2021 if the data breach could have been from a third-party partner, AT&T denied the claims. “Given this information did not come from us, we can’t speculate on where it came from or whether it is valid.”

The dataset contains 73 million lines of data. Names, home addresses, and phone numbers are not masked, although social security numbers and dates of birth are encrypted. This most recent leak has two additional files that provide the social security numbers and dates of birth to match the encrypted data, meaning all information is now accessible.

Several people have conducted an analysis of the data to determine whether a source connected to AT&T is responsible for the leak. Some users identified in the dataset reviewed a very small portion of the data to confirm the accuracy of information and whether they were AT&T customers in 2021. However, such an analysis cannot conclusively confirm the source of the leak.

Within those 73 million lines, there are 49 million unique email addresses and 43 million unique social security numbers. At the time of the leak, AT&T had an estimated 201 million mobile subscribers. Regardless of the source, at most the numbers represent one third of AT&T customers in 2021.