A significant data breach at AT&T in 2024 exposed the communication logs of 109 million customers, highlighting the risks associated with long-term data retention by telecommunications providers, according to a recent report by Bleeping Computer.
The breach involved sensitive metadata, including phone numbers, call durations, text counts and location data from 2022 and 2023. While the stolen records did not include the content of calls or Social Security numbers, security experts warn that call detail records and Session Initiation Protocol messages can be used to reconstruct a person's daily routine, identify close relationships and pinpoint home or workplace locations. The incident underscores a broader industry issue where carriers retain vast amounts of metadata for years, creating attractive targets for cybercriminals. Recent security incidents, including credential-based thefts and state-sponsored campaigns, have demonstrated that such databases are frequently compromised. Industry analysts suggest that the most effective way to mitigate these risks is for carriers to adopt stricter data retention policies, minimizing the volume of information stored. By reducing the duration that metadata remains accessible, companies can significantly lower the potential impact of future security failures on their subscribers.
Source: Bleeping Computer
