Did AT&T breach include AweSIM users?

[lwriemen]

Article on breach: AT&T says criminals stole phone records of 'nearly all' customers in new data breach | TechCrunch

[j_s]

Well there is this:

The stolen data also includes call records of customers with phone service from other cell carriers that rely on AT&T’s network, the company said.

But the dates seem to be from before AweSIM switched to AT&T.

[Sharon]

@lwriemen

Article on breach:

In AT&Ts own quote:
“The data does not contain the content of calls or texts, personal information such as Social Security numbers, dates of birth, or other personally identifiable information,” AT&T said Friday… Associated Press quoting AT&T

[j_s]

The phone numbers at both ends got leaked. A lot of journalists are probably among the victims. Reporters are probably among those keen on bad actors knowing everyone they have talked to for months, possibly also hen and where. If the party on the other end was also an ATT&T (or AT&T reseller) customer, then their location would be known as well.

[Sharon]

well, they said not to worry. Not sure who to believe any more. But still trust in Santa,

They did say …

or other personally identifiable information

so even two numbers that communicate, bad actors won’t know who is at one end and who is the other. ATT&T explains it better.

[amarok]

Quoting Krebs On Security:

However, the company said a subset of stolen records included information about the location of cellular communications towers closest to the subscriber, data that could be used to determine the approximate location of the customer device initiating or receiving those text messages or phone calls.

“While the data does not include customer names, there are often ways, using publicly available online tools, to find the name associated with a specific telephone number,” AT&T allowed.

So that would definitely be concerning to journalists in particular, as you said. They would want to prevent identifying their sources.

But yes, this breach (if you can believe AT&T’s statement) seems to have occurred prior to AweSIM’s switch from a T-mobile provider to an AT&T one:

Puri.sm Down or Just Me?

Purism’s replacement carrier is not located in Los Angeles, so I’m guessing you mean to say that your source is located there? No, there was no outage with AweSIM that I’m aware of, but it is a known user experience issue (L5 only) that you must first set the network mode to 4G Only and new transfers/activations may require a network reset or two (as the customers receive an automated text message from AT&T saying that the number won’t work). This is the user experience issue Purism was trying t…

Cellular Provider update: AT&T?

The previous backhaul network for AweSIM was T-Mobile, but the replacement carrier is AT&T. For this to work, you must set your L5 to use 4G Only. AweSIM’s replacement reseller has privileged account agreements with AT&T and is able to provide the arrangements necessary to enable ongoing support for L5 devices (whereas Android/iOS aren’t a challenge in this regard). Prior challenges involved unsupported IMEIs on the network which often work for a while until they are inevitably kicked off the …

See also (re a previous AT&T breach from 2019):

Cellular Provider update: AT&T?

AT&T is stating that the data is from 2019; AweSIM didn’t exist at the time. Purism also does not share any customer details with the cell reseller. (The previous reseller desired to contractually force Purism into divulging such customer information, which is one of the primary reasons why AweSIM was migrated to the current carrier.) As Purism does not share customer details with AT&T, the data breach does not affect AweSIM subscribers.

[tracy]

About the same time I closed my AT&T account!

The above is from a computer security advert in a computer magazine from the 1990s.