Slashdot Mirror
AT&T Breached, Exposes 19,000 Identities
mytrip writes to tell us News.com is reporting that a recent attack on AT&T's systems saw thousands of customers' personal data compromised. About 19,000 customers of AT&T's online store who purchased equipment for a DSL connection were affected. From the article: "AT&T is offering to pay for credit monitoring services for customers whose accounts have been impacted because they could be at risk of identity fraud. The company also has made available a toll-free number to affected customers to call for more information."
...for using AT&T.
Swedish plasma phys. PhD student; MSc EE; knows maths, programming, electronics; finance interest; seeks opportunities
They will pay for credit monitoring services, but will they pay for all the liability from a stolen ID? That can reach into the hundreds of thousands of dollars in real damage.
I choose to be an Anonymous Coward.
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
Steal someone's identity.
Warhammer forums
I'm not saying AT&T is "the best of us," but your proposed remedies are fucking childish. Do you also support capital punishment for late pizza delivery?
And now, a PSA from David Lynch.
While we're at it.... "thousands of customer's personal..." should be "thousands of customers' personal..." in the write-up. Why do we call the folks that run Slashdot "Editors" anyway?
These companies need to stop collecting this information in the first place. There is no need for AT&T to have this at all to do their business. Last I checked they aren't the Social Security department.
The news here isn't that some incompetent set up their systems, nor that they were cracked. The news is that they've responded openly and meaningfully, without trying to deny it or play down the scale of what happened. I wouldn't be hurrying to sign up to their service because of it, but it certainly doesn't bias me against them. Honesty and integrity are rare enough qualities in corporations that we should applaud them when they claw their way past the lawyers and PR weasels.
If you were blocking sigs, you wouldn't have to read this.
. . . AOL is off the hook.
If this were really happening, what would you think?
How can anyone steal someone else's identity? Oh, you mean they stole people's social security numbers. That should not be a problem, because as we all know, ss numbers are not meant to be used for identification.
The real problem is companies and the govt using SS# for identification. At this point, about 50 ppl know my SS# - the librarian, the assistant at my school, the clerk in the bank, etc, etc. - so any of these people can harm if they don't like me for some reason? This is stupid.
So what next? Some company decides they are going to use FIRSTNAME_LASTNAME as the id and we are all supposed to keep our names a secret? And run around complaining when our 'identity' (FIRSTNAME_LASTNAME) is stolen?
In many countries, you need a notarised signature to obtain loans, etc. While not foolproof, you can always prove it was not you and it takes more effort to commit fraud.
You should not be able to do so much damage with a simple number and some extra data. It is ridiculous that armed with merely this amount of information one could cause so much damage. The system needs to be completely reworked.
This email contains important information that requires your immediate
attention. Please do not reply to this e-mail; instead please use the
telephone number provided below if you wish to contact us.
You previously placed an order with AT&T for DSL-related equipment
through the http://www.sbcdslstore.com/ Website, at which time you
provided certain information including your name, address, e-mail
address, phone number, credit card number and credit card expiration.
(This information did not include your Social Security Number, Driver's
License Number, date of birth, or other identifying information.) AT&T
has learned that a computer containing the information you provided has
been accessed by an unauthorized person, who may have obtained this
information about you.
In addition, AT&T also believes that some customers who purchased
DSL-related equipment from us through this same website may be receiving
e-mails that appear to be from AT&T, but actually are being generated by
an unauthorized third-party (a practice known as "phishing"). These
e-mails refer to your prior order with AT&T and request that you
provide additional personal information such as your Social Security
Number, date of birth, or another credit card number and expiration date.
Please be advised that these e-mails are not being sent by AT&T and are not
legitimate. Do not respond to these e-mails or otherwise provide any of your
personal information in response or at any Website to which the e-mail may
refer you.
We sincerely regret that a third party was able to gain improper access
to your order information and we are working diligently with law enforcement
and major credit card companies to limit your potential exposure. Although
your 3-digit credit card verification number (from the back of your card)
was not stored, and therefore not accessed, we strongly suggest that you
contact your credit card company directly to report this suspected incident
and to protect the credit card you used to purchase this equipment from any
unauthorized activity.
In addition, we suggest that you contact the fraud departments of any one of
the three major credit-reporting agencies and let them know you may be a
potential victim of identity theft. That agency will notify the other two.
Through that process, a "fraud alert" will automatically be placed in each
of your three credit reports to notify creditors not to issue new credit in
your name without gaining your permission. For your convenience, we have
included contact information for all three credit reporting agencies:
Equifax
P.O. Box 740241
Atlanta GA 30374
To report fraud: 1-888-766-0008
Website: http://www.equifax.com/
Experian
P.O. Box 2002
Allen, TX 75013
To Report Fraud: 1-888-397-3742
Website: http://www.experian.com/
TransUnion
Post Office Box 6790
Fullerton, CA 92834
To Report Fraud: 1-800-680-7289
Website: http://www.transunion.com/
Lastly, to provide further security, AT&T is arranging to provide you the
option of enrolling for one year, at no cost to you, in a credit monitoring
service specifically designed to notify you of changes to your credit report
activity in order to detect fraudulent bank or credit card use. The service
will be provided by one of the major credit reporting agencies. We will
provide specific information on this option as part of a letter you will
receive via U.S. Mail in the next few days.
Again, we regret this unauthorized and unlawful access to your order
information and are working with law enforcement to pursue those who
are responsible. We are also reviewing applicable security procedures
in an effort to prevent an incident like this from recurring. Should yo