HackingTelecom & MediaInformationStolen CredentialsData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDCredentialsCriticalActive

AT&T INC.

bd_2c04c4a158e44fd2 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Mar 26, 2024

Filed

Apr 10, 2024

To disclose

15 days

Affected

378,471state residents only

Linked

12 filings

Confidence

68%

Full breach record for AT&T INC. →23 incidents on file

AT&T Inc. notified Washington AG of a data breach involving customer PII (names, SSNs, DOBs, account numbers, passcodes) found in a dark web dataset released March 17, 2024. AT&T determined the compromise on March 26, 2024. 378,471 Washington residents affected. AT&T reset passcodes and offered credit monitoring. Investigation ongoing; source of incident unidentified.

J jump to incidentP pin to compareR raw source

Washington clock✓ WA AG ≤30d15 days discovery → filing

⚠ AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Incident timeline

undetected · 9 days

discovery → filing · 15 days

Mar 17, 2024

Begins

Mar 26, 2024

Discovered

Apr 10, 2024

Filed

This filing is one of 12 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Massachusetts State AGbd_36f4d420cf6fa07e2024-04-10Verified
Oregon State AGbd_7534be63ba9185ec2024-04-10Verified
South Carolina State AGbd_54dc2a4241a0af372024-04-09 · +1dCandidate
California State AGbd_962bc7783c26b3452024-04-09 · +1dVerified

Show 6 more filings ↓up to 15d gap

Montana State AGbd_9c10bf1a6486d8102024-04-09 · +1dVerified
Vermont State AGbd_ae9a0cefc958af772024-04-09 · +1dVerified
Indiana State AGbd_ff7d944ebd2888c92024-04-09 · +1dVerified
New Hampshire State AGbd_79d7d9a7036db0e92024-04-15 · +5dVerified
Illinois State AGbd_cf6680ffde30d0f82024-04-01 · +9dVerified
Delaware State AGbd_5109fdbae81c15502024-04-25 · +15dVerified

Showing first 10 of 11 linked disclosures.

Name: Gibson, Dunn, & Crutcher LLP
norm: gibson dunn crutcher

Name: AT&T INC.
norm: at t
Domain: att.com
Industry: Telecom & Mediallm

Discovered: Mar 26, 2024
Breach occurred: Mar 17, 2024 – Mar 26, 2024
Undetected for: 9 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 9, 2024
Affected individuals: 378,471state-resident count only
Data types: Identity (basic)Government IDCredentials
Data elements: NameSocial Security numberDate of birth
WA-stated cause: Theft or Mistake
WA-stated duration: lifecycle 0dexposure 0d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Unknown
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Initial access: valid_credentials

During the incident: Launched a robust investigation supported by internal and external cybersecurity experts
Reset account passcodes for impacted customers
Sent email notifications to current and former customers
Provided notice to impacted residents via U.S. mail
Offering one year of complimentary credit monitoring, identity theft detection and resolution services provided by Experian’s IdentityWorksSM
Changes made: Regularly reviewing and updating measures to protect information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 days(15 days from discovery to filing)
Compliance flags: WA AG ≤30d
Discovery-date grounding: AG web formThe discovery date came from the AG web-form field, which is systematically later than the detection date stated in the letter. Treat the clock as indicative.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 11 states

View merged incident ↗

Illinois State AGApr 1 · first

South Carolina State AG+8d

California State AG+8d

Montana State AG+8d

Vermont State AG+8d

Indiana State AG+8d

Massachusetts State AG+9d

Oregon State AG+9d

Washington State AG+9d · this page

New Hampshire State AG+14d

Delaware State AG+24d

Pattern: first filing Apr 1 (IL), last Apr 25 (DE) — a 24-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 11 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachA28614.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 10, 2024
Raw hash: 18b1278734dee596e556f79c136455a11307a19d25f087dad96ea3133834017f

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityGibson, Dunn, & Crutcher LLP

Victim entityAT&T INC.

Incidentdiscovered Mar 26, 2024

Stated responseLaunched a robust investigation supported by internal and external cybersecurity experts

ComplianceWA AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com