Last week AT&T made this post on the new section of their website titled AT&T addresses recent data set released on the dark web. As you can see, the date of this post is March the 30th, 2024. The big problem here though is that this AT&T data set, which includes information like the names, addresses, phone numbers, and social security numbers for over 70 million, current and former AT&T customers has been floating around on the dark web for about three years now. But only recently did it get released publicly for literally anyone to download. Two weeks ago, a threat was posted to a friendly neighborhood dark web hacker forum that may or may not be an FBI honeypot after Pom Pom Purin got arrested in New York last year. But anyway, this post was made titled AT&T 70 Mill Database 2021. That's right, this data is originally from 2021 and like I said, the people whose private information is in this database are only just now finding out about it. So the data was originally posted by a user named Shiny Hunters who was trying to sell the database. That's a pretty common thing in these hacker communities, people try to sell breach data to other hacker mans who want to use them for different kinds of fraud. I mean, you've got to imagine that if you've got a database with names, birthdays, social security numbers, and addresses for all these people, then you could probably open up some credit cards in their names, apply for loans or impersonate AT&T and convince someone to pay an overdue bill with some Google play cards or some Bitcoin. I mean, the possibilities are endless. But as things tend to go in the data trade, this data gets cheaper as it ages because people make copies of the database and they sell it for cheaper and other places. Some of the victims might have already been exploited by the data leak and now they're going to be harder to exploit in the future, which is where we end up getting posts like this from Major Nelson, where they just give away the data for free that someone may have once paid thousands of dollars for. Or maybe they got it for free from a more obscure dark web forum because this is still one of the most popular ones, even though it may or may not be an FBI honey pot and how that it's original owner was arrested. But this user here definitely got something out of it. They got some reputation points. I mean, they literally gained like 30 reputation points for this post alone. But AT&T on the other hand should really lose some reputation points because just as recently as March 17th, the same day that this leak was posted to our favorite FBI honey pot, AT&T themselves were denying that the leak even came from their systems. They've been denying this data breach since August 2021 when shiny hunters was trying to auction it off. And they only admitted to this data breach when the data essentially became publicly available. For the past three years, at least one cyber criminal has had access to this database. And it's because of these lies and really AT&T's failure in the first place to secure this customer data that different lawsuits are being filed against AT&T now. And if you're an AT&T customer, you really should be following this class action lawsuit to see if you'll be entitled to some compensation in the future because this is a ridiculous fail in protecting users data. There were samples of the data that were made publicly available back in 2021 with the original post. I mean, that's just part of the whole black market data sales process. People have to make some of the data publicly available so others can look at it and try to figure out whether it's legit or not. So AT&T could have easily accessed the forum. I mean, it was actually easier to access before the new owners took over it. But they could have accessed it. They could have verified the sample data in their systems. And then they could have taken a proactive approach three years ago to warn their customers of this breach so that they could have gotten identity theft protection. Change their emails, their phone numbers, credit card numbers or take whatever measures they see necessary. But instead of doing that, AT&T chose to say not on because the full database was behind a heck and pay wall on the dark web. It's not like anyone's actually going to see it. And I still don't know if AT&T has directly reached out to the victims of this to tell them what happened. I guess comment below if you're a customer and you've gotten an email from them because I'm not an AT&T customer. Thank goodness. But one, I guess good thing that AT&T did do which turned out to be very much necessary was they reset everybody's account pass codes. Now the account pass code in this case is necessary to do different things with your AT&T account. It's similar to a transfer pin that you would have to give them to transfer your phone number to a new SIM card. Which is how a SIM swap attacks are typically done by the way. Now the reason these pass codes had to be reset is because they were listed in the database, but in an encrypted format. Now if we take a look at the about your AT&T pass code section on their website, they tell us right here that it is a four digit AT&T pass code. And when you tell a normie that they have to come up with a four digit pass code, 90% of the time that code is going to be something like their data birth or the last four digits of their Social Security number, their Street number, part of their phone number, something that's pretty easy for you to figure out. And what do you know? All of that data is in plain text right next to the encrypted pass code. Well, technically the birthdays are encrypted to in this master file, which is what pretty much contains everything. But there's this other file called DOB1 that contains key value pairs for every single birthday going from 111900 to 1231, 2016. So these values can be translated pretty easily. And the cherry on top of this information security fail cake is that it appears AT&T didn't properly salt their pass codes. That's right. Out of 70 million entries, there's only 10,000 or so unique pass codes because AT&T only lets you use four digits for the pass codes. And they don't put no season in on the password hashes. So you could just use the plain text data and the knowledge of how people choose pass codes to deduce what these encrypted pass codes are without ever actually breaking their encryption scheme. And even though AT&T prompted people to change their pass codes, their new code is probably still something that's pretty easily figured out, especially with all the data that's in this leak. Like, okay, best case scenario may be someone change their pass code to their spouses birthday. But chances are that person uses AT&T as well. They probably live at the same address as your target. So that data is going to be in the leak as well and pretty easy to find. My guess is that people are going to be victimized from this leak for years to come. So if you're an AT&T customer, you really should keep an eye out for identity theft. Obviously don't reuse that pass code anywhere. And if you're ever forced to create a really insecure pass code like that, you know, for digit numeric only pass code, try your damnedest to not use something as obvious as the last four digits of your social security number or your data birth or your spouses' data birth or you know something that can easily be found in a database leak like this or through some social engineering. But really, I think all cell phone carriers should go towards using these more secure pass codes. There's some that I've seen and you know other people analyzing this have seen some that appear to be a little bit longer. So maybe it is possible to create pass codes longer than four digits with AT&T. But I've been with a couple different cell phone providers and it seems like they always either limit you to four digits or they encourage you to make the pass code only four digits. So yeah, we should probably stop doing that. We should probably start creating transfer pins that are at least eight digits, alpha numeric so that you know we're not going to get polled by stuff like this. But if you enjoyed this video, please like it and share it to hack the algorithm and check out my online store. Based on when you can get awesome merch like the tie-dye tour team, the come and find it hoodie and you can get accessories for your phone and laptop. 10% discount at checkout when you pay in Monero XMR. Have a great rest of your day.