AT&T said hackers have stolen the personal information of 73 million current and former customers. The data, including Social Security numbers, appears to be from 2019 or earlier, AT&T said in a statement, and includes account information for approximately 7.6 million current account holders and 65.4 million former customers.
The leak first came to light in 2021, when hackers claimed they’d stolen customer data from AT&T and would put the information up for sale. Fast-forward to March 2024, the stolen personal information was discovered on the dark web, according to Troy Hunt, creator of Have I Been Pwned.
In response, AT&T said it has contacted the 7.6 million current customers and has reset their passcodes. Whether you’re in the smaller set of current customers or the larger group of former account holders who think their data has been stolen in the breach, you can take steps to potentially lessen the damage of the breach. Read on for what you can do. AT&T didn’t immediately respond to CNET’s request for comment.
For more, here’s our picks for the best identity theft protection and monitoring services and how Consumer Report’s permission slip can help you take control of your online data.
What to know about the AT&T data leak
AT&T on March 30 said that personal information of 73 million current and former customers was leaked in mid-March to the dark web. The company said the stolen information appears to be from 2019 or earlier, and it does not know if the information came from AT&T or one of its vendors.
What personal information was stolen in the AT&T breach?
According to AT&T, which customer and account data was stolen may vary by account, but thieves had access to customers’ full name, email address, mailing address, phone number, Social Security number, date of birth, AT&T account number and passcode. AT&T said the information doesn’t appear to contain personal financial information or call history.
What is an AT&T passcode?
A customer’s passcode is essentially a numerical PIN and is usually four digits. A passcode is different from a password and is required to complete an AT&T installation, perform personal account functions by phone or contact technical support by phone, AT&T said.
How to reset your AT&T passcode
AT&T said it has already reset the passcodes for those active accounts where data was stolen but recommends if you haven’t changed your passcode in the past year, you should change yours as a precaution. Here’s how to change your AT&T passcode.
- Head to your myAT&T Profile. Sign in, if asked. (If you have extra security enabled and can’t sign in, AT&T says, choose Get a new passcode)
- Scroll to My linked accounts
- Select Edit for the passcode you want to update
- Follow the prompts to finish up
Where can you check if you are part of the AT&T breach
AT&T said it will email or mail a letter to the 7.6 million current customers whose data was stolen, explaining the incident, what information was compromised and what it is doing in response. The company said it has reset passcodes for affected current customers. The company said it is also communicating with the 65.4 million former account holders whose data was stolen.
You don’t have to wait for AT&T to contact you, however. Using Have I Been Pwned, you can check whether your data has been leaked. If you store your password information in a Google account, the company’s Password Checkup tool can alert you if your account information has been exposed. And the premium version of our favorite password manager, Bitwarden, can check for stolen passwords on the web.
Changing your passcode and password, if AT&T hasn’t contacted you, can help secure your account.
How to monitor your credit report for fraud
If you think your personal information was part of the AT&T breach, you can watch your credit reports for signs of potential fraud.
Monitor your credit reports. You get one free credit report a year from the three major credit bureaus: Equifax, Experian and TransUnion. On your report, look for unusual or unfamiliar activity, such as the appearance of new accounts you didn’t open. And watch your credit card accounts and bank statements for unexpected charges and payments.
Sign up for a credit monitoring service. Pick a credit monitoring service that constantly monitors your credit report on major credit bureaus and alerts when it detects unusual activity. To help with the monitoring, you can set fraud alerts that notify you if someone is trying to use your identity to create credit. A credit-reporting service like LifeLock can start at $7.50 a month — or you could use a free service like the one from Credit Karma.
What to do if you suspect you’re a victim of fraud or identity theft
As soon as you suspect your personal information has been stolen, take action to stop unauthorized charges and start to recover your identity.
Place a fraud alert. If you suspect fraud, place a fraud alert with each of the credit reporting companies: Equifax, Experian and TransUnion. The alert notifies creditors that you have been a victim of fraud and lets them know to verify with you new credit requests in your name. You can place an initial fraud alert, which stays on your credit report for 90 days, or an extended fraud alert, which stays on your credit report for seven years. Placing a fraud alert won’t affect your credit score.
Contact fraud departments. For each business and credit card company where you think an account was opened or charged without your knowledge, contact its fraud department. While you’re not responsible for fraudulent charges to an account, you need to report the suspicious activity promptly.
Freeze your credit. If you want to stop anyone from opening credit and requesting loans and services in your name without your permission, you can freeze your credit. You will need to request a freeze with each of the three credit reporting companies, which again are Equifax, Experian and TransUnion. To apply for new credit, you need to unfreeze your credit, again, through each of the credit reporting companies. You can either request a temporary lift of the freeze or unfreeze it permanently.
Create a recovery plan. The Federal Trade Commission has a valuable tool that helps you report identity theft and recover your identity through a personal recovery plan and Identity Theft Report, which you can use to dispute charges.
Document everything. Keep copies of all documents and expenses and records of your conversations about the theft.
For more, here are our favorite password managers and the best VPN services.
