AT&T Breached, Exposes 19,000 Identities 143
mytrip writes to tell us News.com is reporting that a recent attack on AT&T's systems saw thousands of customers' personal data compromised. About 19,000 customers of AT&T's online store who purchased equipment for a DSL connection were affected. From the article: "AT&T is offering to pay for credit monitoring services for customers whose accounts have been impacted because they could be at risk of identity fraud. The company also has made available a toll-free number to affected customers to call for more information."
Re: (Score:2, Funny)
Re: (Score:1, Funny)
>>Yes, we know. Grammar here's defected.
>>Yeah, it's not like the editors couldn't of fixed that.
>The editors could care less about grammar. Nor idiom.
AIIEEEEEEEEEEEE!!!!<head explodes>
(It's 5:30 A.M. here - what a way to start the day!)
Re: (Score:1)
Re: (Score:1)
Re: (Score:3, Informative)
Perhaps an appropriate punishment (Score:5, Funny)
Re: (Score:1, Offtopic)
Re: (Score:2)
Re: (Score:3, Interesting)
Has ANYONE set up a clearinghouse for these security breaches so I can keep an eye on where (not if) my private information is leaking?
O RLY? (Score:5, Insightful)
Heck, frankly... (Score:3, Interesting)
Now that may not be very likely, but if I were the yesmen, I'd be perched and waiting for another ID theft scandal, because nothing would be more meta than stealing the ID of a PR person handling an ID theft incident.
Re: (Score:1, Flamebait)
It wasn't stolen, it was "shared". Making a copy doesn't take anything away from the original owners, right? They still have their names, social security numbers, etc.
A few days ago you said "copying a CD is not a crime". Make up your mind. If information wants to be free, copyright should be abolished, etc., then the same princi
Re:O RLY? (Score:4, Insightful)
Re: (Score:2)
Oh wait, maybe not.
Re: (Score:1)
two people are not breaking into the record companies computers to get the music.
Re: (Score:2)
Pretty subtle, eh?
Re: (Score:2, Insightful)
It wasn't shared (that implies willingness). If anything, it was "exposed", because it was suposed to be secret or confidential information, something a Britney Spears CD is not (but I would not arge with you if it should).
Re: (Score:1)
Re: (Score:2)
Wake me up when downloading a track from emule gets thousands of dollars in creditcard debt taken out in the artist's name by kids on IRC, illegal immigrants getting forged licenses with the label president's drivers license number or getting a job using their SSN, or terrorists buying an internet connection in their name and using it to plan their next bombing run.
Until then, your attempt to c
No copyright (Score:1)
I know you mean this as a joke, so this isn't directed at the poster really. Still I have to worry that some people might actually believe what you just wrote there. The only thing on a SS-card or a credit card might be the artwork, everything else has no copyright.
And the fact that these people had their ID stolen is extremely sad. Everytime I get an ad in the mail from my bank wanting me to buy id-theift protection I want to call them and ask about racketeering... Have these people zero liability when
Re: (Score:3, Insightful)
I used the term "principle" for a reason. The principle I'm referring to is control. The legal technicalities are different - which is why I specifically did not refer to them. But the principle is the same: the right of a person to control and/or limit the distribution of specific bits of information. To demand that right for one's self while at the same time trying to deny it to others is hypocrisy, plain
Re:O RLY? (Score:5, Insightful)
That's true. And if the identity thieves stop there, simply filing their collection of stolen identities away and displaying a few choice specimens above the mantle for when guests come over, I don't have a problem with it (well a small one, but I can deal).
When the identity thieves use those stolen identities to clean out bank accounts, take out fradulent loans, and steal real, physical goods using credit cards in the victim's name, then they do take something the owner no longer has. IHBT. HAND.
Re: (Score:2)
Re: (Score:2)
Copyright is about restricting the freedom of the user of the stuff.
The distributor performs the service of giving you the information, and you pay for it. End of story, no agreement, no contract.
Then, there is a law that says that your freedom to distribute the information you paid to access is restricted. You have to wait a lot of time, virtually forever, and then you can share it anyway you like.
About private information, you enter an agreement with someone to share it with them, and they h
Re: (Score:2)
No, it's more about protecting the freedom and interests of whoever made a work of art, which is its intention.
Re: (Score:2)
No, it's more about protecting the freedom and interests of whoever made a work of art, which is its intention.
It's about protecting the interests of the original distributor, at the expense of restricting the users freedom, if you want to say it that way.
The original intent was about the authors, right now it's more tailored to the needs of distribution companies rather than creators themselves, at least in most countries. For examp
Re: (Score:2)
Re: (Score:2, Insightful)
Who modded the troll up? (Score:3, Informative)
Copyright won't protect your personal information in any way. So perhaps you should go troll an RIAA article now. Perhaps if there's an article about how a fi
Re: (Score:2)
What crowd? The "copying a CD is not a crime" quote was exactly that - a direct copy-and-paste quote from an earlier post made by the person I replied to. I wasn't referring to any mythical "crowd", I was referring to two contradictory (IMHO) statements that were made by the same person.
You might also want to look up the definition of the term "troll" - it doesn't mean what you think it means. It isn't anyo
Good enough (Score:2)
An early post not related to the article-at-hand.
Aside from that, you're talking about the 'rights of others' in reference to corporate ip holders, which insinuates that corporations are entitled to the same rights as private individuals.
But if you want to go back over old different-topic comments made... perhaps I can browse all recent flameish and offtopic moderations you've accumulated recently:
Offtopic [slashdot.org]
Flamebait [slashdot.org]
Re: (Score:1)
Re: (Score:1)
[America is 100% corrupt - anyone who does not know this is ignorant - but there is a cure for ignorance - it's called knowledge and awareness.]
Thats exactly why... (Score:4, Insightful)
Re: (Score:2)
Only "thousands"? (Score:5, Interesting)
Re:Only "thousands"? (Score:4, Insightful)
Will the CTO of AT&T resign like AOL's did over the search history release, which was significantly less damaging than this.
I'm putting my money on No, personally.
-- Azaroth
Re:Only "thousands"? (Score:5, Insightful)
This was a break-in, not a "spill", which was detected by AT;&T, on the weekend at which time they took very active measures (shutting down the site and contacting credit card companies). Sounds to me like they have some pretty good procedures in place already; you know, the kind of thing a CTO is responsible for.
Really? (Score:2)
Employees (or ex employees)
The software (and/or software creator)
The operating system (and/or OS creator)
and millions of points in-between. People want the convenience of credit cards and online access, unfortunately there is no foolproof security for this. For ever better vault, a better thief will emerge.
Re: (Score:2, Informative)
In other news (Score:2, Insightful)
"AT&T infects 19'000 of their customers with AIDS, after a 'breach' of their 'security' yesterday.
AT&T is offering to pay for free condoms for all affected customers."
Re: (Score:1)
Oi! Hie Thee to Strunk and White! (Score:1, Insightful)
Affected is preferred.
Effected suggests being brought into being. A database security breach that effects 19000 new customers would not only bring the wrath of the accountants at the Security and Exchange Commission, but also suggests a militant AI broken loose in ATT!
In response to the A/C that suggested we're; you can remember that a comma suggests a contraction of we are.
God is an Iron; Engish was my most hated and worst subject. I leave a glass of Wry for my fellows, but I had to learn this grammer st
Re: (Score:1)
lol
Re: (Score:1, Funny)
I sympathize with your cause, but the effort above is unacceptable. Shape up or ship out of the Grammar Reich, soldier.
Re: (Score:2)
Why did ATT allow the possibility? (Score:2)
Or... did they do that, but the crackers were able to pierce the firewall?
Re: (Score:1)
Stop collecting SS# (Score:4, Insightful)
Re: (Score:1)
And if you must know these businesses usually keep this stuff on record for more than one reason which includes taxes (incase of an audit) returns (so they can put it back on the original credit card because it would be illegal to transfer the balance to another)
and believe it or not but some people do actually sign up to have their cc billed automatically everymonth.
Re: (Score:1)
Good for them (Score:5, Insightful)
It looks like . . . (Score:4, Insightful)
Steal identity? (Score:5, Insightful)
The real problem is companies and the govt using SS# for identification. At this point, about 50 ppl know my SS# - the librarian, the assistant at my school, the clerk in the bank, etc, etc. - so any of these people can harm if they don't like me for some reason? This is stupid.
So what next? Some company decides they are going to use FIRSTNAME_LASTNAME as the id and we are all supposed to keep our names a secret? And run around complaining when our 'identity' (FIRSTNAME_LASTNAME) is stolen?
In many countries, you need a notarised signature to obtain loans, etc. While not foolproof, you can always prove it was not you and it takes more effort to commit fraud.
Re: (Score:2)
Re: (Score:3, Interesting)
Re: (Score:2)
Re: (Score:2)
An id-number works perfectly well for *identifying* a certain person. (the bank, the tax-man, the car-registration-people, the unemployment-office and many more will all recognize that a certain number corresponds to a certain pe
This goes back to the original problem.. (Score:3, Interesting)
Re: (Score:2)
No no no NO NO no... and N-O! (Score:2)
1. MD5 is weak/broken. No MD5. Erase it from your vocabulary. Replace it with SHA-256 or better.
2. How many SSNs are there? At max, 1 billion (assuming they go 000-00-0000 to 999-99-9999). A reverse lookup directory of 1 billion 256-bit hashes would take around 36 gigabytes of disk space (if my math is correct).
3. If you add salt to it, then the salt becomes a secret key to the routine. Lose that key, and someone can re-create the lookup in a matter of hours (minutes?).
Really, you want to just create a
See there is the problem... (Score:1)
Check out AT&T's wrongdoing (Score:1)
English, Part II (Score:1, Offtopic)
19,000 customers EFFECTED?!?!?!? (Score:1)
NSA hard at work (Score:2)
Cable companies? (Score:2)
What really matters (Score:1)
Scope Creeps (Score:3, Insightful)
Then we'd see American corporations rush to rewire their databases to protect customers, instead of protecting their advantages in charging and marketing to us, and the risk that their few bucks benefit will destroy our lives.
Re: (Score:2)
Re: (Score:2)
If AT&T was found liable for these exposures to probably 500K subscribers the past few years at $5K each cost for protection, that's $2.5B. They might try to pass the cost on to all their subscribers, but they'd find subscribers dropping and switching to competitors. While it pro
I got hit by this one (Score:1, Interesting)
I was surprised to be prompted to enter m
Re: (Score:2)
they should do more to protect the customers. (Score:1)
Where there's smoke (Score:1)
This is small time compared to the egregious breach of privacy experienced by nearly everyone with AT&T's complicity with the NSA's illegal splitting operations in San Francisco and elsewhere. AT&T is at it again time for more anti-trust remedies.
Re: (Score:3, Insightful)
Ultimately, they're put betweewn "a rock and a hard place" because they have no immediate legal recourse for a demand placed on them from the highest level of government. They're already govt. regulated as it is - and failure to comply wi
Re: (Score:1)
Why go to all the trouble break in? (Score:3, Insightful)
Looks like I was on that list (Score:5, Interesting)
attention. Please do not reply to this e-mail; instead please use the
telephone number provided below if you wish to contact us.
You previously placed an order with AT&T for DSL-related equipment
through the http://www.sbcdslstore.com/ [sbcdslstore.com] Website, at which time you
provided certain information including your name, address, e-mail
address, phone number, credit card number and credit card expiration.
(This information did not include your Social Security Number, Driver's
License Number, date of birth, or other identifying information.) AT&T
has learned that a computer containing the information you provided has
been accessed by an unauthorized person, who may have obtained this
information about you.
In addition, AT&T also believes that some customers who purchased
DSL-related equipment from us through this same website may be receiving
e-mails that appear to be from AT&T, but actually are being generated by
an unauthorized third-party (a practice known as "phishing"). These
e-mails refer to your prior order with AT&T and request that you
provide additional personal information such as your Social Security
Number, date of birth, or another credit card number and expiration date.
Please be advised that these e-mails are not being sent by AT&T and are not
legitimate. Do not respond to these e-mails or otherwise provide any of your
personal information in response or at any Website to which the e-mail may
refer you.
We sincerely regret that a third party was able to gain improper access
to your order information and we are working diligently with law enforcement
and major credit card companies to limit your potential exposure. Although
your 3-digit credit card verification number (from the back of your card)
was not stored, and therefore not accessed, we strongly suggest that you
contact your credit card company directly to report this suspected incident
and to protect the credit card you used to purchase this equipment from any
unauthorized activity.
In addition, we suggest that you contact the fraud departments of any one of
the three major credit-reporting agencies and let them know you may be a
potential victim of identity theft. That agency will notify the other two.
Through that process, a "fraud alert" will automatically be placed in each
of your three credit reports to notify creditors not to issue new credit in
your name without gaining your permission. For your convenience, we have
included contact information for all three credit reporting agencies:
Equifax
P.O. Box 740241
Atlanta GA 30374
To report fraud: 1-888-766-0008
Website: http://www.equifax.com/ [equifax.com]
Experian
P.O. Box 2002
Allen, TX 75013
To Report Fraud: 1-888-397-3742
Website: http://www.experian.com/ [experian.com]
TransUnion
Post Office Box 6790
Fullerton, CA 92834
To Report Fraud: 1-800-680-7289
Website: http://www.transunion.com/ [transunion.com]
Lastly, to provide further security, AT&T is arranging to provide you the
option of enrolling for one year, at no cost to you, in a credit monitoring
service specifically designed to notify you of changes to your credit report
activity in order to detect fraudulent bank or credit card use. The service
will be provided by one of the major credit reporting agencies. We will
provide specific information on this option as part of a letter you will
receive via U.S. Mail in the next few days.
Again, we regret this unauthorized and unlawful access to your order
information and are working with law enforcement to pursue those who
are responsible. We are also reviewing applicable security procedures
in an effort to prevent an incident like this from recurring. Should yo
Re: (Score:2)
Althought, switching to Speakeasy was the happy part.
Future transcript (Score:2)
Me: Well, let's see, first there was that whole Internet tapping thing.
AT&T: I'm not sure which Internet tapping situation you're referring to...
Me: GOOD GOD, THERE'S MORE THAN ONE?! Hold on, let me pull up my blog!
AT&T: No, sir, I meant I'm not personally aware of any Internet tapping. I assure you that AT&T values your privacy...
Me: And then you cooperated with the NSA in their illegal do
Re:Will AT&T pay for.... (Score:2)
Were you potentially a victim of this crime? You seem to be taking it fairly personally - as evidenced by your rater exagerated counterpoints. I for one am willing to give AT&T credit for at least offering to help in some way - most of the times I've read about this happening the company involved didn't offer to pay for anything.
Look, shit happens to the best of us. (Score:3, Insightful)
Re: (Score:1)
*claps*
I was trying to find a way to say just that. Kudos.
Re: (Score:1, Funny)
Yesterday's pizza was late, I was so fucking hungry I wanted to kill the guy.
Re: (Score:3, Insightful)
Late pizza is the least of my worries.
Re:not my fault... (Score:5, Funny)
Steal someone's identity.
Re: (Score:2)
Re: (Score:1)