AT&T Shells Out $370K to Hacker to Delete Stolen Phone Records

Earlier this week, news spread of an AT&T hack involving stolen call records for tens of millions of its customers. As it turns out, AT&T reportedly paid a hacker $370,000 to delete the data and provide video proof of the deletion.

Wired spoke with the hacker and reports the random was paid in May. The hacker was reportedly part of the ShinyHunters hacking group that has stolen data from a number of different victims through unsecured Snowflake cloud storage accounts.

The hacker provided the address for the cryptocurrency wallet that sent them the payout, and Wired was able to confirm that the transaction for 5.7 bitcoin was sent to the account on May 17th before being laundered through several other accounts.

The hacker reportedly initially requested $1 million from AT&T but eventually settled for a fraction.

AT&T is one of more than 150 companies whose data was stolen during April and May through poorly secured Snowflake accounts. Other companies include Ticketmaster, Advance Auto Parts, LendingTree, and the bank Santander.

Earlier this week, AT&T said it had taken steps to close the illegal access point to its data and is “working with law enforcement in its efforts to arrest those involved in the incident.”

The FCC is also investigating the breach. 

While the hacker deleted the entire dataset, AT&T customers may still be at risk from samples of the data obtained by others.

AT&T says it believes “at least one person” responsible for the breach has been apprehended.