Categories Data Security and Privacy

AT&T reportedly paid hacker $370,000 to delete stolen customer data

AT&T Reportedly Paid Hacker $370,000 to Delete Stolen Customer Data

In an unusual twist of events, AT&T paid over $370,000 to a hacker to delete stolen customer data, following a major data breach earlier this year. The breach, disclosed in April, exposed the call and text records of nearly all AT&T customers, including phone numbers and the number of calls made.

In a filing to the U.S. Securities and Exchange Commission (SEC), AT&T stated that it had enhanced its cybersecurity measures and was cooperating with law enforcement. However, Wired reported that AT&T also paid a ransom of 5.7 Bitcoin to a member of the hacking group ShinyHunters in mid-May, amounting to over $373,000 at the time. The hacker allegedly erased the stolen data from a cloud server, providing video proof of the deletion.

Despite the payment, there’s no guarantee that the data is completely gone, as digital data can be easily copied. The security researcher who facilitated the negotiations believes that the complete dataset was deleted, though incomplete fragments might still exist.

There is ongoing ambiguity around the identity of the hacker responsible for the initial breach. An individual who received the ransom blamed known hacker John Binns, who was arrested in Turkey earlier this year for the 2021 T-Mobile hack. While Binns’ connection to the AT&T breach is not confirmed, AT&T’s SEC filing did state that at least one person involved had been arrested.

Further complicating matters, the hacker claimed that Binns distributed samples of the data to others, who would have tried to extort a ransom had Binns not been apprehended. Originally demanding $1 million, the hackers settled for a lesser amount, which was transferred to a nominated cryptocurrency wallet. The hacker then deleted the data from a cloud server used by Binns.

The hacker group ShinyHunters has been linked to numerous high-profile hacks, including a recent demand for an $8 million ransom following a Ticketmaster breach affecting around 440,000 ticket holders. This breach, like the AT&T hack, involved a third-party cloud storage provider, Snowflake.

AT&T has faced multiple cybersecurity challenges recently. An unrelated leak in March exposed data of approximately 73 million current and former customers, including Social Security numbers and encrypted passwords.

Source: AT&T reportedly paid hacker $370,000 to delete stolen customer data.