Massive AT&T data breach exposes call logs of 109 million customers

AT&T confirmed that threat actors accessed a Snowflake database and stole call and text metadata for approximately 109 million mobile customers between April 14 and April 25, 2024. The exposed records include telephone numbers, interaction counts, aggregate call durations, and some cell site IDs (but not call/text content, customer names, SSNs, or dates of birth). The intrusion is linked to credential theft via infostealer malware and associated with a broader wave of Snowflake account compromises (tracked to UNC5537); AT&T is working with law enforcement, has implemented mitigations, and reports no evidence the data has been publicly released.