The Federal Communications Commission (FCC) has reached a $13 million settlement with AT&T to resolve a probe into whether the telecom giant failed to protect customer data after a vendor’s cloud environment was breached three years ago.

The FCC’s investigation also looked into AT&T’s supply chain integrity and whether the telecom giant engaged in poor privacy and cybersecurity practices.

The massive data breach investigated by the FCC occurred in January 2023, when threat actors accessed customer data of roughly 9 million AT&T wireless accounts stored by a vendor contracted to generate personalized video content, including billing and marketing videos.

“Customer Proprietary Network Information from some wireless accounts was exposed, such as the number of lines on an account or wireless rate plan,” AT&T told BleepingComputer at the time.

“The information did not contain credit card information, Social Security Number, account passwords or other sensitive personal information. We are notifying affected customers.”

The CPNI data exposed in the January 2023 breach included customer first names, wireless account numbers, phone numbers, and email addresses.

Even though the vendor was required to destroy or return the data after the contract ended—years before the breach—it failed to do so. AT&T was found to have inadequately monitored the vendor’s compliance with their contractual obligations.

“Carriers must take additional precautions given their access to sensitive information, and we will remain vigilant in ensuring that’s the case no matter which provider a customer chooses.”

AT&T agrees to boost customer data protection

To settle the investigation, AT&T has also agreed to strengthen its data governance practices to protect its consumers’ sensitive data against similar vendor data breaches in the future.

The consent decree mandates AT&T to implement a comprehensive Information Security Program that includes broad customer data protection, improve its data inventory processes to track data shared with vendors, ensure that vendors follow retention and disposal rules for customer information (to limit the amount of customer data vulnerable to date breaches), and conduct annual compliance audits to assess AT&T’s compliance with these requirements.

“The Communications Act makes clear that carriers have a duty to protect the privacy and security of consumer data, and that responsibility takes on new meaning for digital age data breaches,” said FCC Chairwoman Jessica Rosenworcel.

“Carriers must take additional precautions given their access to sensitive information, and we will remain vigilant in ensuring that’s the case no matter which provider a customer chooses.”

Enforcement Bureau Chief Loyaan A. Egal also underscored the significance of the case, noting that “Communications service providers have an obligation to reduce the attack surface and entry points that threat actors seek to exploit in order to access sensitive customer data.”

In July 2024, AT&T warned of another massive data breach after threat actors stole the call logs for roughly 109 million customers (nearly all of its mobile customers) from an online database on the company’s Snowflake account between April 14 and April 25, 2024.

The exposed data contained phone numbers, call durations, communications metadata, and number of calls or texts. However, AT&T said the attackers couldn’t access the content of the calls or texts, customer names, or any other personal information like Social Security numbers or dates of birth.

In April, the company also notified 51 million former and current customers of a data breach linked to a massive amount of AT&T customer data leaked in March on the Breached hacking forum and previously offered for sale for $1 million in 2021.