Slashdot Mirror
AT&T Call Centers Sold Mobile Customer Information To Criminals
itwbennett writes Employees at three call centers in Mexico, Colombia and the Philippines sold hundreds of thousands of AT&T customer records, including names and Social Security numbers, to criminals who attempted to use the customer information to unlock stolen mobile phones, the U.S. Federal Communications Commission said. AT&T has agreed to pay a $25 million civil penalty, which is the largest related to a data breach and customer privacy in the FCC's history.
So that's what? 1/500th of a month's revenue for AT&T? Geez, they must be stinging for that hand slap!
1. Only $25M for that egregious violation??
2. And that is the *LARGEST* penalty ever????
Token penalties like that are equivalent to declaring a free-for-all-big-corps.
Bent, folded, spindled, and mutilated.
to AT&T? And maybe Verizon/Comcast?
I can't think of anyone more criminal.
But but but that will never happen! The government and companies are responsible with our data!
Who cares about you? Why are you so special? lol you're paranoid
That's a switch...usually they just give that information away for free to criminals.
This isn't an improvement for customers, but at least its better for stockholders.
It is time to adopt a system similar to Finland, where fines for infractions such as speeding is proportional to income and ability to pay. For AT&T to pay $25 million for this kind of ridiculous breach in security is outrageous. Exactly what economic incentive does AT&T have to change their ways or improve security? If you answered "None. Zero. zip. Zilch.", you win the prize!
So they sold them back to AT&T they're saying?
How's that "best shore" strategy working out for ya?
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
I have long felt that companies should legally have to disclose if not, get consent to share your personal information outside your home country. I don't say this because people in other countries are any less trustworthy. My reasoning is that a person has more ability to control their risk exposure and be provided with known forms of legal recourse when their information isn't unknowingly shared or transmitted outside their own country. I've never been comfortable with the idea that when I call into a call center, they don't tell me where they are located. Now if I share my personal info with that agent, how would I possibly know if US laws and protections apply to the data I share or if the call center's IT environment is regulated to U.S. standards for audit compliance and data protection? How would I know if a breach of that unknown foreign call center network would be reported as it would under U.S. law?
That explains the increase I just saw in my bill. An extra $15... they are already trying to squeeze their customers to pay for the fine.
If telephones are outlawed, then only outlaws will have telephones.
To whom will they pay the fine? The FCC?
They should divide the $25M (or at least a very high % of it) and pay it to the "hundreds" of people that were actually affected.
This is about 5 minutes of AT&T's profits (maybe less). Each of those customers should get another $10K in compensation, plus any losses already incurred, and fraud monitoring in perpetuity paid by AT&T. Also, since their social security numbers have been compromised, do they get new ones? Along with new credit cards? And bank accounts?
A wrist slap AT&T doesn't need. A whack upside the head with a brick may work better in getting them to correct their processes to avoid this cruft.
How about instead of a fine... They make them stop, forever, the unnecessary spam calls I get on my AT&T personal mobile phone every couple of days. I know that would ruin the FCC's plan they had with all the money to do the same thing with what is left over after giving out bonuses, vacations and raises to everyone at the FCC.
These companies are run by scumbags and douchebags. They should make it 10% of their gross. That should get there attention and make sure it doesn't happen again anytime soon.
From TFA:
"AT&T has “no reason to believe” that the stolen customer records were used for identity theft or financial fraud, the company said in a statement."
"AT&T has “no reason to believe” that the stolen customer records have been used for identity theft or financial fraud yet, the company said in a statement."
[ftfTFA] It is at times like these that I feel like we should be telling companies to take a hike when they require information like SSNs to sign up for an account.
An internal system operation returned the error "The operation completed successfully.".
I wonder if this was discussed at the meetings when they calculated the savings of outsourcing the work and that outsourcing being offshore. I guess they don't teach that at business schools. Ideally these people would not have access to this data to even sell but again, the risks were considered and they took a chance at a savings instead.
At least Cisco was able to get the federal government (FBI/CIA) to pay the bill, police the situation, and mitigate the risks of their outsourcing problems when they noticed when their "counterfeit" equipment started showing up inside the US borders. Cisco played the angle that the counterfeit equipment was a potential security risk. Instead of the government getting involved and investigating, they should have just stopped buying Cisco equipment with a notice that it was their problem, not the US taxpayers.
Why would a phone company (or any other non-government entity) even think about asking for a social security number? I was offered almost $100 off a purchase last summer if I signed up for a store's credit card, but they absolutely insisted that I had to give them my SSN, so I turned down their generous offer and won't ever go back there. Stupid, stupid, stupid.
I was thinking that they sold it to CapitalOne. Everyone else seems to.
they'll sell information to criminals using the information for identity theft instead of unlocking stolen phones.
AT&T didn't sell the information this time. Some AT&T employees stole the information and sold it. AT&T is being fined for having lax procedures that allowed the original theft.
What is your solution?
By the way, the use of profanity does not strengthen your argument.
But we already knew they were selling data to the government.
*badum tish*
maybe the fine should be their quarterly profits :)
Why do criminals need to unlock cell phones? They can just buy their own AT&T SIM card and put it a the AT&T cell phone. I'm confused!
So the easiest way to foil your plan is for companies who plan on doing nefarious things, to incorporate small companies with less than 20 employees and use them as a dedicated scape goat. How does Finland deal with that?
It would be very difficult to prevent actually.
Some job titles within the Company require access to the databases that contain this information. It's just part of their job. They HAVE to have it so when you call in for whatever reason, they can look it up and deal with your issue.
The IT folks that maintain the servers where this information is stored will have full access to ALL the information in that database. So will the folks who run the backups.
How would you prevent this kind of problem ? You have to trust someone.
Apple imposes a $50 million fine for leaks, GT Advanced reveals
Perhaps LG is now facing more of the same, for leaking two whole characters: "8K".
What I'm hoping is that LG pushes back, and when it goes to court LG successfully argues they didn't tip any technical parameters about a forthcoming Apple product, because "K" doesn't mean 1000, and "K" doesn't mean 1024, and in fact doesn't mean any number at all, contrary to what the Apple marketing people apparently think.
So a couple low-level workers go all Snowden/Manning and steal company data and sell it on the open market, and their employer is stuck with a $25M fine... Seems fair.
Ken
25 million? Thats nothing considering they deliberatly sold that stuff. Why does goverment use such soft punishments... This docent even send signal that you should not do this again...
They sold it to criminals? Is that like to other phone companies or especially ISPs? Or merely to the NSA?
All three or notorious for corruption .. in everything! Why should we be surprised that AT&T call centers are vulnerable to corrupt employees?
All information on private and public databases in Mexico is passed to criminal groups who the use it to plan kidnappings and fraud and extortion schemes. For example voter's: http://www.alternet.org/story/16598/mexican_data_grab. Until very recently techers in Acapulco were forced to hand over 50% of their salary to organized crime, who had access to payroll records: http://www.insightcrime.org/news-analysis/acapulco-schools-closed-as-even-teachers-are-sucked-into-mexicos-drug-war.
Some of those databases are openly sold at Plaza Santo Domingo in Mexico City, the traditional place to get forged documents: http://www.justice.gov/eoir/vll/country/canada_coi/mexico/MEX100643.E.pdf. Have a good trip.