AT&T reaches settlement over 2023 data breach, agrees to pay $13 million

AT&T found itself in some hot water with the FCC back in January 2023 when it was discovered that a partnering vendor had suffered a data breach involving AT&T customer information. While AT&T was not directly responsible for the breach, it allegedly failed to ensure that the vendor had destroyed the data when it was no longer needed, making AT&T liable. AT&T has now finally settled the issue with the FCC (via ArsTechnica), agreeing to pay a $13 million fine and implement stricter controls on sharing data with its vendors.

The main issue was that the data collected should have been destroyed years earlier. Even though the breach wasn’t entirely AT&T’s fault, the law requires carriers to protect customer data. Therefore, it makes sense that the carrier would be held accountable for having lax or unclear policies around how to manage shared data.

It’s worth noting that while this is a serious security issue, the breach did not expose highly sensitive information such as credit card details, account passwords, or Social Security numbers. Instead, it included more basic information, like the number of lines on an account.

We reached out to AT&T for a statement on the FCC ruling, and here’s what their representative had to say:

“Protecting our customers’ data remains one of our top priorities. A vendor we previously used experienced a security incident last year that exposed data pertaining to some of our wireless customers. Though our systems were not compromised in this incident, we’re making enhancements to how we manage customer information internally, as well as implementing new requirements on our vendors’ data management practices.”

What kind of enhancements is AT&T making exactly? According to the public version of the FCC’s consent decree, AT&T will be required to make significant investments in safeguarding data shared with third-party vendors. The decree also states that AT&T must require vendors to adhere to retention and disposal obligations related to customer information, limiting the quantity of customer data vulnerable to breaches. Additionally, AT&T must conduct annual compliance audits on all its vendors, and the FCC will be actively involved in ensuring AT&T meets its obligations under the settlement. The Commission will enforce these stricter requirements for the next three years.

Overall, while this data breach could have been a much bigger deal if more sensitive information had been exposed, AT&T can easily afford the fines. Still, this is a win for consumers, as it shows the FCC is taking data breaches seriously and holding carriers accountable. Even though companies like AT&T can handle the financial penalties, their reputation takes a hit if they don’t tighten security measures. Ultimately, this means breaches like this will hopefully become far less common in the future.