AT&T call and text records stolen from its Snowflake workspace
AT&T said in a July 12, 2024 8-K that between April 14 and April 25, 2024 threat actors accessed an AT&T workspace on a third-party cloud platform, which AT&T confirmed to press was Snowflake, and exfiltrated records of calls and texts for nearly all its wireless customers from mid-2022. The records held phone numbers, interaction counts, durations and some cell site IDs, not content.
- Victim
- AT&T
- Industry
- Telecom
- Country
- United States
- Intrusion began
- Apr 14, 2024
- First disclosed
- Jul 12, 2024
- Actor
- Financially motivated
- Initial access
- Stolen credentials
- Identity control that failed
- Authentication
- MFA
- Not enforced on the abused account
- Abused identity
- Human account
- Records affected
- 110 million (Nearly all AT&T wireless customers and MVNO customers on its network for May to October 2022 and January 2, 2023, per the 8-K; press reported about 110 million people.)
- Disclosed cost
- Not disclosed
The identity lesson
Metadata on more than 100 million people sat behind a single-factor login to an analytics workspace; MFA and network allow lists on that account were the missing controls.
Regulatory and legal outcome
The US Department of Justice twice authorized AT&T to delay public disclosure under Form 8-K Item 1.05(c), on May 9 and June 5, 2024.
Go deeper on SWI
Sources
- AT&T Form 8-K (Item 1.05), US SEC, Jul 12, 2024
- AT&T disclosed a new data breach that exposed call logs of almost all customers, Security Affairs, Jul 12, 2024
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Neiman Marcus customer data stolen from its Snowflake account 2024 · Stolen credentials
- Advance Auto Parts job applicant data stolen from its Snowflake account 2024 · Stolen credentials
- Snowflake customer tenant extortion campaign (UNC5537) 2024 · Stolen credentials
- Ticketmaster customer data stolen from its Snowflake account 2024 · Stolen credentials
Cite this record
SWI Community Team. (2026). AT&T call and text records stolen from its Snowflake workspace. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2024-att-snowflake-call-records/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.