As technology use in business evolves with new technological advances emerging in industries such as AI, blockchain, business intelligence, and more, progress brings a fair amount of issues. Issues of difficulty with technology integration, data management, and managing remote workers in the Digital Age have come to the forefront with long-time concerns such as skill gaps and security risks becoming increasingly relevant. This year has seen several data breaches in companies that handle millions of customer data or are suppliers to many companies. Economically, shares for such companies have fallen as inflation stays at a high.
Earlier this year, in March, AT&T announced how a dataset on the dark web had personal information such as Social Security numbers for approximately 7.6 million current AT&T account holders and 65.4 million former account holders. AT&T recently publicly announced information about another breach discovered early this year involving the data of approximately 109 million customer accounts downloaded to a third-party platform in a security breach.
The breach occurred between May 1, 2022, and Oct. 31, 2022, with a small number of customers impacted on Jan. 2, 2023. The compromised data included files from AT&T records of calls and texts from cellular, wireless networks, and landline customers. From Jan. 2, 2023, records identify the telephone numbers an AT&T or MVNO cellular number interacted with and a subset of one or more cell site identification number(s) associated with these interactions.
While the company records identify the phone numbers an AT&T number interacted with and do not contain the content of calls, texts, or personally identifiable information (PII), a name can be linked to a phone number with online searches. Thomas Richards, principal consultant at Synopsys Software Integrity Group, clarifies the risk to privacy.
“While the information… exposed doesn’t directly have sensitive information, it can be used to piece together events and who may be calling who. This could impact people’s private lives as private calls and connections could be exposed," Richards said. “The business phone numbers will be easy to identify and private numbers can be matched to names with public record searches.”
The ongoing investigation is engaged with cybersecurity experts to understand the nature and scope of the breach. AT&T identified the third-party platform involved with the breach as a cloud company called Snowflake and said the incident was limited to an AT&T workplace on its platform.
Consequently, cyber security experts say the massive volume of data on cloud platforms controlled by companies can create issues. With the increasing data reliance, it has become harder for companies to offer protection to their customers. Field Chief Technology Officer Roei Sherman at Mitiga, a threat detection and investigation company on cloud technology, outlines the relationship between this data breach and urgent issues that can cause long-term problems further down the road.
“The AT&T data breach underscores the growing risks associated with the vast amounts of data companies now store on cloud and SaaS platforms," said Sherman. “As organizations increasingly rely on these technologies, the complexity of detecting and investigating breaches has risen sharply.”
AT&T will notify current and former customers whose information was involved. Since AT&T has contracts for several federal agencies including the State Department, Department of Homeland Security, and the Department of Defense, the incident may pose a national security concern by exposing communication networks for people in national security roles. Chief Pierson, chief executive of the cybersecurity company BlackCloak, adds a new perspective.
“The most likely beneficiary of this specific data…[is] foreign nation states or… actors,” Mr. Pierson said.
Fortunately, AT&T has government support in investigating the security breach that caused extensive data and privacy risks.
The investigation is being supported by the Federal Bureau of Investigation and the Department of Justice (DOJ) “through the first and second delay process, all while sharing key threat intelligence to bolster FBI investigative equities and to assist AT&T’s incident response work” as well as the Federal Communications Commission.
The DOJ revealed it became aware of the breach early this year; however, the security breach met the security standard for a delayed filing with the U.S. Securities and Exchange Commission since an earlier disclosure of the breach would “pose a substantial risk to national security and public safety.”
Worcester Polytechnic Institute Professor Patrick Schaumont, whose research focuses on cybersecurity and hardware security, emphasizes this concern.
“Any breach connected to phone data is a “serious” privacy issue given how many online services are connected to phones these days,” said Schaumont.
Beyond AT&T, recent cyberattacks have damaged operations and released data belonging to Ticketmaster customers, hospital patients, and others. With some cases having the primary goal of disrupting services so providers are likely to pay ransoms, it is more important than ever for businesses to build data management and cybersecurity. As consumers, we must stay aware of the risks of technology use and decide what services to use to stay safe while still gaining the benefits.
__________________________________________________________________________________
Sources & References
Comentários