The Midnight Alert: Navigating the Dark Web Data Dilemma

On March 31, 2024 AT&T acknowledged that a dataset containing customer personally identifiable information (including Social Security numbers and PINs) that had been for sale on the dark web since 2021 belonged to the company; the affected records are reported to be from 2019 or earlier and reportedly exclude call history and financial data. The report then shifts to guidance for CISOs on proactive data management (asset and data mapping, classification, third‑party assessment), comprehensive logging and auditing for incident investigation, and building a structured threat hunting program to detect and respond to data exfiltration.