AT&T Data Breach Exposes 109 Million Customer Call Logs, Highlighting Carrier Data Retention

AT&T Data Breach Details

In April 2024, AT&T disclosed a data breach that compromised the communication logs of 109 million customers. The exposed information included phone numbers, the number of calls and texts, call durations, and location data. This data spanned from May to October 2022 and January 2023, impacting both current and former subscribers.

Nature of Exposed Data

While AT&T stated that the breach did not include call content, customer names, or Social Security numbers, call logs themselves are highly sensitive. This metadata, comprising Session Initiation Protocol (SIP) messages and Call Detail Records (CDRs), can reveal significant personal details. SIP messages manage call and text sessions, while CDRs summarize each interaction, including participants, timing, duration, and cell site usage.

Implications of Call Log Exposure

Access to call logs allows for the identification of close relationships, determination of home and work locations, and reconstruction of daily routines. For example, a record of calls to an oncologist or texts to a friend can provide a detailed timeline of personal events. This metadata can also be correlated with publicly available information to derive identities, as demonstrated by Malte Spitz's case in 2011, where he reconstructed years of his activities from 35,000 records obtained from his telecom.

Carrier Data Retention Practices

A key factor contributing to the risk of such breaches is the long retention period for call logs. Most carriers do not specify exact retention times, often stating data is kept "as long as necessary." However, in 2022, carriers informed the FCC chair that geolocation data, a component of call logs, is retained for up to five years. This extended retention makes these records an attractive target for malicious actors.