The “Customer Proprietary Network Information (CPNI)” from some wireless accounts was accessed by an unauthorized person, according to AT&T, who discovered the breach in a vendor’s system.
Over 9 million AT&T customers were informed that some of their information had been compromised.
“We recently determined that an unauthorized person breached a vendor’s system and gained access to your “Customer Proprietary Network Information” (CPNI)”, in a notice sent to an AT&T customer.
CPNI is information related to the telecommunications services customers purchase, such as the number of lines on your account or the wireless plan to which you are subscribed.
Which Information Was Revealed?
The first name, wireless account number, wireless phone number, and email address of the customers were among the information exposed, according to AT&T, which also provides additional details about the issue on their website.
“It also included the number of lines on the account and basic device (e.g., iPhone 7) and installment agreement information that was used to help indicate device upgrade eligibility”.
“A small percentage of impacted customers also had exposure or rate plan name, past due amount, monthly payment amount, various monthly charges and/or minutes used”, according to AT&T.
They also highlight that “No credit card information, SSN, date of birth, account passwords, or specific device IDs (e.g., IMEI or SIM) was involved,” and that the customer information was several years old.
The company noted that the vendor security breach did not affect its systems and that the leaked data mostly related to eligibility for device upgrades.
“We have notified federal law enforcement about the unauthorized access of your CPNI as required by the Federal Communications Commission,” said AT&T, first detected by DataBreaches.net
“Our report to law enforcement does not contain specific information about your account only that the unauthorized access occurred”.
Customers who already have an AT&T account are urged to consider adding their free “extra security” password protection to the account.
Users are urged to disable CPNI data sharing on their accounts by submitting a CPNI Restriction Request in order to mitigate their exposure risks in the case that AT&T decides to use the data for third-party vendor marketing in the future.
Network Security Checklist – Download Free E-Book