FEDERALItem 1.05 · mandatoryHackingTelecom & MediaInformationWired TelecomStolen CredentialsData ExfiltratedCustomer Data InvolvedSupply Chain (3P Vendor)Multi-Stage ChainMetadataLocationPIILowContained

AT&T INC.

bd_a4373d2af8bc759a · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 19, 2024

Filed

Jul 12, 2024

To disclose

12 weeks

Affected

Not disclosed

Linked

13 filings

Confidence

64%

Full breach record for AT&T INC. →19 incidents on file

AT&T Inc. disclosed that threat actors accessed a third-party cloud workspace between April 14-25, 2024, exfiltrating call and text metadata (logs) for nearly all wireless customers from May 2022 to Jan 2023. The data includes phone numbers, interaction counts, durations, and some cell site IDs, but not call content or PII like SSNs. AT&T contained the access and is cooperating with law enforcement. DOJ approved a delayed disclosure.

J jump to incidentP pin to compareR raw source

Leak gap clock✗ Leak >180d12 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 5 days

discovery → filing · 12 weeks / 84 days

Apr 14, 2024

Begins

Apr 19, 2024

Discovered

Jul 12, 2024

Filed

This filing is one of 13 about the same incident.View merged incident

A leak claim by everest about this victim predates this filing by 623 days.View originating leak claim

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

Delaware State AGbd_5109fdbae81c15502024-04-25 · +78dVerified
New Hampshire State AGbd_79d7d9a7036db0e92024-04-15 · +88dVerified
Washington State AGbd_2c04c4a158e44fd22024-04-10 · +93dVerified
Massachusetts State AGbd_36f4d420cf6fa07e2024-04-10 · +93dVerified

Show 6 more filings ↓up to 94d gap

Oregon State AGbd_7534be63ba9185ec2024-04-10 · +93dVerified
South Carolina State AGbd_54dc2a4241a0af372024-04-09 · +94dCandidate
California State AGbd_962bc7783c26b3452024-04-09 · +94dVerified
Montana State AGbd_9c10bf1a6486d8102024-04-09 · +94dVerified
Vermont State AGbd_ae9a0cefc958af772024-04-09 · +94dVerified
Indiana State AGbd_ff7d944ebd2888c92024-04-09 · +94dVerified

Showing first 10 of 12 linked disclosures.

Name: AT&T INC.
norm: at t
SEC CIK: 0000732717
Domain: att.com

Name: AT&T INC.
norm: at t
SEC CIK: 0000732717
Domain: att.com
Industry: Telecom & Medianaics map
NAICS 517111 · Wired Telecommunications Carriers

Discovered: Apr 19, 2024
Breach occurred: Apr 14, 2024 – Apr 25, 2024
Undetected for: 5 daysoccurrence → discovery
Materiality determined: Jul 12, 2024
Notification sent: —
Affected individuals: Not disclosed
Data types: MetadataLocationPII
Attack vector: Third-Party / Supply Chain
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 ChannelT1195 Supply Chain Compromise
Threat actor: External
Regulator citations: U.S. Department of Justice determined that a delay in providing public disclosure was warranted
Initial access: supply_chain

During the incident: Activated its incident response process
Retained external cybersecurity experts to assist
Closing off the point of unlawful access
Working with law enforcement in its efforts to arrest those involved
Changes made: Taken additional cybersecurity measures in response to this incident
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(84 days from discovery to filing)
Compliance flags: Leak >180d
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 10 states

View merged incident ↗

South Carolina State AGApr 9 · first

California State AGApr 9 · first

Montana State AGApr 9 · first

Vermont State AGApr 9 · first

Indiana State AGApr 9 · first

Washington State AG+1d

Massachusetts State AG+1d

Oregon State AG+1d

New Hampshire State AG+6d

Delaware State AG+16d

SEC 8-K+94d · this page

Pattern: first filing Apr 9 (SC), last Jul 12 — a 94-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 12 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statementThis record

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://www.sec.gov/Archives/edgar/data/732717/000073271724000046/t-20240506.htm
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jul 12, 2024
Raw hash: 8ebb2dc7d325c0ba45b274f24c90afe85e8d9b1e8ae6ed026b66ab3f0ec84148

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html76.0 KB

Download View at source

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityAT&T INC.

Victim entityAT&T INC.

Incidentdiscovered Apr 19, 2024

Stated responseActivated its incident response process

ComplianceLeak >180d

Extraction provenanceno artifact recorded

Source provenancewww.sec.gov

Source filing