Telecom giant AT&T has said it found personal data of 73 million current and former customers were leaked on the dark web two weeks ago.
“While AT&T has made this determination, it is not yet known whether the data in those fields originated from AT&T or one of its vendors,” the company said in a statement.
With respect to the balance of the data set, which includes personal information such as social security numbers, the source of the data is still being assessed, the company said.
AT&T said it has launched a robust investigation supported by internal and external cybersecurity experts.
“Based on our preliminary analysis, the data set appears to be from 2019 or earlier, impacting approximately 7.6 million current AT&T account holders and approximately 65.4 million former account holders,” the telecom major said.
AT&T said it currently does not have evidence of unauthorized access to its systems resulting in exfiltration of the data set.
“The company is communicating proactively with those impacted and will be offering credit monitoring at our expense where applicable. We encourage current and former customers with questions to visit www.att.com/accountsafety for more information,” the company said.
The company said the incident has not had a ‘material impact’ on AT&T’s operations.
Information on the leak was first revealed by x user vx-underground on March 17.
“Today 70,000,000+ records from an unspecified division of AT&T were leaked onto Breached. No information is available to indicate whether it is a 3rd party compromise, or which ‘division’ this data is from,” the user said.
“Regardless, upon review we can confirm the stolen data is legitimate,” the post said.
