Break-in at 'third-party cloud platform' leaked 110M customer records, says AT&T

AT&T disclosed that a compromise of a third-party Snowflake cloud account resulted in the theft of call and text metadata for nearly 110 million wireless customers (including MVNO customers). The stolen records reportedly include call/text details and, in some cases, cell-tower identifiers that could enable rough geolocation; investigators believe attackers used credential stuffing with stolen credentials (sometimes harvested by info‑stealing malware) and that affected accounts lacked multifactor authentication. Law enforcement involvement and at least one arrest were reported; the incident follows an earlier AT&T data exposure this year and appears tied to mass intrusions into individual Snowflake customer instances.