Slashdot Mirror
AT&T Breached, Exposes 19,000 Identities
mytrip writes to tell us News.com is reporting that a recent attack on AT&T's systems saw thousands of customers' personal data compromised. About 19,000 customers of AT&T's online store who purchased equipment for a DSL connection were affected. From the article: "AT&T is offering to pay for credit monitoring services for customers whose accounts have been impacted because they could be at risk of identity fraud. The company also has made available a toll-free number to affected customers to call for more information."
They will pay for credit monitoring services, but will they pay for all the liability from a stolen ID? That can reach into the hundreds of thousands of dollars in real damage.
I choose to be an Anonymous Coward.
In other news:
"AT&T infects 19'000 of their customers with AIDS, after a 'breach' of their 'security' yesterday.
AT&T is offering to pay for free condoms for all affected customers."
Affected is preferred.
Effected suggests being brought into being. A database security breach that effects 19000 new customers would not only bring the wrath of the accountants at the Security and Exchange Commission, but also suggests a militant AI broken loose in ATT!
In response to the A/C that suggested we're; you can remember that a comma suggests a contraction of we are.
God is an Iron; Engish was my most hated and worst subject. I leave a glass of Wry for my fellows, but I had to learn this grammer stuff in self-defence. Which I shall maintain in a Court of Law.
Oh, Strunk and White, "the Elements of Style" is a fast way to invigorate your writings. Well worth getting.
This is progress?
I'm not saying AT&T is "the best of us," but your proposed remedies are fucking childish. Do you also support capital punishment for late pizza delivery?
And now, a PSA from David Lynch.
Will the CTO of AT&T resign like AOL's did over the search history release, which was significantly less damaging than this.
I'm putting my money on No, personally.
-- Azaroth
These companies need to stop collecting this information in the first place. There is no need for AT&T to have this at all to do their business. Last I checked they aren't the Social Security department.
The news here isn't that some incompetent set up their systems, nor that they were cracked. The news is that they've responded openly and meaningfully, without trying to deny it or play down the scale of what happened. I wouldn't be hurrying to sign up to their service because of it, but it certainly doesn't bias me against them. Honesty and integrity are rare enough qualities in corporations that we should applaud them when they claw their way past the lawyers and PR weasels.
If you were blocking sigs, you wouldn't have to read this.
To you and the GP:
This was a break-in, not a "spill", which was detected by AT;&T, on the weekend at which time they took very active measures (shutting down the site and contacting credit card companies). Sounds to me like they have some pretty good procedures in place already; you know, the kind of thing a CTO is responsible for.
No folly is more costly than the folly of intolerant idealism. - Winston Churchill
. . . AOL is off the hook.
If this were really happening, what would you think?
How can anyone steal someone else's identity? Oh, you mean they stole people's social security numbers. That should not be a problem, because as we all know, ss numbers are not meant to be used for identification.
The real problem is companies and the govt using SS# for identification. At this point, about 50 ppl know my SS# - the librarian, the assistant at my school, the clerk in the bank, etc, etc. - so any of these people can harm if they don't like me for some reason? This is stupid.
So what next? Some company decides they are going to use FIRSTNAME_LASTNAME as the id and we are all supposed to keep our names a secret? And run around complaining when our 'identity' (FIRSTNAME_LASTNAME) is stolen?
In many countries, you need a notarised signature to obtain loans, etc. While not foolproof, you can always prove it was not you and it takes more effort to commit fraud.
Corporations should not be allowed to store personal info longer than the duration of the transaction, or transmit it outside the scope of the transaction. AT&T should be prosecuted for liability, including lifetime exposure to ID fraud. AT&T security and policy managers and directors should hold personal liability, piercing the corporate liability veil.
Then we'd see American corporations rush to rewire their databases to protect customers, instead of protecting their advantages in charging and marketing to us, and the risk that their few bucks benefit will destroy our lives.
--
make install -not war
Couldn't HAVE fixed that, you fucking moron. First have a look at yourself before spouting your shit. Retard.
Hell, they probably could have just *asked* for the information and AT&T would have handed it over...
There's no place I can be, since I found Serenity.
Huh? The responsibility for that illegal operation should rest squarely on the shoulders of the current presidential administration. You can't reasonably expect any company in AT&T's position not to comply with something like that - no matter how evil the request is.
Ultimately, they're put betweewn "a rock and a hard place" because they have no immediate legal recourse for a demand placed on them from the highest level of government. They're already govt. regulated as it is - and failure to comply with such an order could effectively put a freeze on their ability to do business at all.
I think their smartest business move was to just go along with things, but not to interfere when it gets challenged in court either. This is between the govt. and the people, with AT&T getting drug into the middle of things because they owned the technology that needed to be tapped into to make the spying plans work.
Lost: Sig, white with black letters. No collar. Reward if found!