AT&T reversed course and said most FirstNet numbers were in the breached data

AT&T disclosed on July 12, 2024 that attackers had downloaded call and text metadata covering nearly all of its wireless customers. The records were taken from an AT&T workspace on the cloud platform Snowflake between April 14 and April 25, 2024, and covered interactions from May 1 to October 31, 2022. TechCrunch reported that the dataset touched around 110 million customers and included phone numbers, call and text counts and durations, and in some cases cell site identifiers.

AT&T builds and operates FirstNet, the nationwide public safety broadband network overseen by the First Responder Network Authority within the U.S. Department of Commerce. Federal, state, local and tribal agencies, including police, fire and emergency medical services, use it.

In its first statements AT&T said the majority of FirstNet subscribers as of the end of 2022 were not in the compromised data. On July 19, 2024 the company reversed that position, saying its initial assessment of the percentage of FirstNet numbers in the data had been incorrect and that the proportion was similar to that of its broader customer base. Nextgov/FCW first reported the change.

AT&T said the stolen records did not include the content of calls or messages, or customers' names, Social Security numbers or financial information. Public notification had been delayed twice at the request of the FBI and the Justice Department, which cited potential risks to national security and public safety. AT&T said at least one person had been apprehended in connection with the wider Snowflake intrusion campaign.