AT&T has consented to a $13 million fine following an incident where it provided customer billing information to a vendor for the creation of personalized videos and subsequently failed to ensure the data’s destruction. The Federal Communications Commission (FCC) disclosed this agreement on Monday, revealing that the vendor’s breach exposed the information of 8.9 million wireless customers in January 2023. For details on the consent decree, refer to the FCC document.
The data breach occurred despite federal regulations mandating phone companies to safeguard customer data. The FCC criticized AT&T for relying on the vendor’s assurances rather than verifying the destruction of sensitive information. A company’s press release stated that the vendor had contractual obligations to return or destroy AT&T customer data after use, obligations that ended years before the breach.
According to the FCC, the data should have been deleted by 2018, although it remained in the vendor’s cloud environment until it was compromised. AT&T shared this data between 2015 and 2017. The vendor was supposed to have securely destroyed or deleted it by 2018. The breach exposed sensitive customer details, including bill balances, payment information, and rate plan names for a small fraction of those affected.
In a statement to Ars Technica, AT&T clarified that the compromised data did not include credit card details, Social Security Numbers, or account passwords. The company notified affected customers in March 2023 and has since reported that it found no evidence of account-related fraud linked to the breach. For more information, visit the Ars Technica article.
Though AT&T did not directly address the FCC’s allegations regarding its failure to protect customer data adequately, it has announced measures to improve internal data management and set stricter requirements for vendor data practices.