On Wednesday, the Federal Communications Commission announced that AT&T would pay $25 million to settle an investigation into data breaches that occurred at the company's call centers in Mexico, Colombia, and the Philippines. The FCC said that at least two employees confessed to stealing private information belonging to thousands of US customers, including names, full and partial social security numbers, and account-related data, known as customer proprietary network information (CPNI). CPNI data is usually found on a person's phone bill and contains call metadata.
In all, the FCC estimates that almost 280,000 US customers were affected.The commission also said that it had been looking into whether AT&T had promptly notified law enforcement regarding the theft of customers' CPNI.
According to a consent decree between the FCC and AT&T (PDF), the commission began investigating the matter in May 2014 when it learned of a possible data breach that occurred between November 2013 and April 2014 at a Mexican call center that AT&T contracted with to provide Spanish-language customer support services. AT&T told the FCC's Enforcement Bureau that it found that three employees of the call center had used login credentials improperly to steal names and the last four digits of social security numbers.
When questioned, at least two of the employees told the FCC “that they sold the information obtained from the breaches to a third party, known to them as 'El Pelón,'" which in Spanish refers to a bald man. According to The New York Times, “[t]he employees sought out the names and details corresponding to specific phone numbers that El Pelón had provided.” Those names and details were used to request handset unlock codes for stolen AT&T phones and for secondary market phones that El Pelón or others wanted to unlock. According to a senior FCC official speaking to The New York Times, "AT&T terminated its contract with the Mexican call center in September."
The FCC found out about the breach when AT&T reported it in April 2014 to the California attorney general. At the time, AT&T sent letters to affected customers notifying them of the breach. Executive Director for Media Relations Mark Siegel told Ars in 2014, "This is completely counter to the way we require our vendors to conduct business... We have taken steps to help prevent this from happening again, notified affected customers, and reported this matter to law enforcement."
In March 2015, the FCC told AT&T that it would be investigating similar matters at call centers in Bogotá, Colombia and in the Philippines. During its investigation, AT&T told the FCC's Enforcement Bureau that some 40 call center employees in Colombia and the Philippines also obtained “customer names, telephone numbers, and at least the last four digits of customer Social Security numbers” pertaining to approximately 211,000 customer accounts.
In addition, a history of lax privacy practices were found in the foreign call centers. “In Bogota, until May 27, 2014, full Social Security numbers were accessible in the ordinary course of business to three of the managers whose login credentials were used in these activities,” the FCC wrote. “After May 27, 2014, AT&T implemented measures to mask full Social Security numbers for AT&T Mobility Call Center managers.” AT&T said that it never found any evidence that those three managers had used the Social Security numbers improperly.
The New York Times noted that the $25 million fine is the largest that the FCC has ever issued for data security and privacy violations.
Update: In a comment e-mailed to Ars Technica, an AT&T spokesperson wrote, "Protecting customer privacy is critical to us. We hold ourselves and our vendors to a high standard. Unfortunately, a few of our vendors did not meet that standard and we are terminating vendor sites as appropriate. We’ve changed our policies and strengthened our operations. And we have, or are, reaching out to affected customers to provide additional information.
reader comments
64