AT&T to Pay $13 Million Settlement Over Vendor Data Breach

An AT&T logo at the entrance of a building in Washington on June 11, 2019. Eva Hambach/AFP/Getty Images

AT&T has agreed to pay $13 million to settle a Federal Communications Commission (FCC) investigation into a vendor-related data breach that compromised the information of millions of the company’s customers.

The FCC said in a Sept. 17 announcement that the $13 million settlement resolves an Enforcement Bureau investigation into AT&T’s supply chain integrity and whether the company failed to protect its customers’ information in connection with a data breach of one of its vendors, who should not have been holding AT&T customer information.

“Today’s announcement should send a strong message that the Enforcement Bureau will not hesitate to take action against service providers that choose to put their customers’ data in the cloud, share that data with their vendors, and then fail to be responsible custodians of that data,” Loyaan Egal, chief of the Enforcement Bureau and chair of the FCC’s privacy and data protection task force, said in a statement.

The January 2023 breach of an unidentified vendor previously used by AT&T led to the exposure of data collected from 8.9 million AT&T customers.

“Under AT&T’s contracts, the vendor should have destroyed or returned AT&T customer information when no longer necessary to fulfill contractual obligations, which ended years before the breach occurred,” the FCC said in the announcement.

The agency alleged that AT&T failed to ensure the vendor adequately protected customer information and verify that the vendor had either returned or destroyed the data.

Information exposed in the breach included details such as the number of lines on customers’ accounts and, in some cases, billing balances and rate plan details. Sensitive information, including credit card numbers, Social Security numbers, and account passwords, was not compromised, according to both AT&T and the FCC.

As part of the settlement, known as a consent decree, AT&T has committed to enhancing its data governance practices and strengthening its vendor oversight. Specifically, AT&T will implement a comprehensive information security program designed to protect customer data, enhance tracking of customer information through a new inventory system, and enforce stricter data retention and disposal obligations for its vendors.

Additionally, the company will introduce multifaceted vendor controls, conduct annual compliance audits to ensure adherence to the new protocols and limit vendor access to sensitive information to only what is necessary for business operations.

“Protecting our customers’ data remains one of our top priorities,“ an AT&T spokesperson told The Epoch Times in an emailed statement. ”A vendor we previously used experienced a security incident last year that exposed data pertaining to some of our wireless customers,” the spokesperson said.

“Though our systems were not compromised in this incident, we’re making enhancements to how we manage customer information internally, as well as implementing new requirements on our vendors’ data management practices.”

In a separate, unrelated incident, AT&T disclosed in July that customer data had been illegally downloaded from a third-party cloud platform in April 2024. The breach affected “nearly all” AT&T cellular customers and included records of calls and texts from May to October 2022. No personal information, such as Social Security numbers or the content of messages, was compromised, according to AT&T, which said it had secured the system and was working with law enforcement.