AT&T Hack Puts Millions of Users at Risk of SIM Swapping

AT&T recently disclosed[1] a massive data breach affecting “nearly all” of its cellular customers, who may now be at risk of SIM swapping attacks. According to the telecom giant, the breach occurred when customer data was downloaded off of its “workspace on a third-party cloud platform.” The incident also affected customers who use its mobile virtual network operators, as well as landline customers who interacted with affected cellular numbers between May and October 2022. 

As Reuters[2] reported, the hackers obtained data for “109 million customer accounts.” The data did not include personal identifying information like social security numbers, nor the contents of phone calls or text messages. “We are working with law enforcement in its efforts to arrest those involved in the incident,” AT&T wrote. “We understand that at least one person has been apprehended.”

If you were a victim of an AT&T hack, your mobile provider may be liable to you pursuant to the Federal Communications Act and regulations promulgated thereunder. To receive a free, confidential consultation about your case, call our law firm at 800-767-8040.

What Is SIM Swapping?

SIM swapping[3] is a form of identity theft in which criminals use various techniques to commandeer a victim’s mobile phone number. Also known as SIM hijacking, SIM splitting, or simjacking, the scam is designed to gain fraudulent access to your bank or cryptocurrency accounts. It requires criminals to convince your mobile phone carrier to connect your phone number with their SIM (Subscriber Identity Module) card. As such, victims of SIM swapping may be able to sue their mobile carrier to recover losses.

How Does SIM Swapping Work?

When someone calls your cell phone, your mobile carrier recognizes that the number is connected with your SIM card and sends the call to your device. In SIM swapping schemes, criminals manipulate your mobile carrier into connecting the number with a SIM card under their control. As the Federal Bureau of Investigation warned[4] in 2022, they usually do this through one of three techniques:

• Social engineering, in which they impersonate their victim in an effort to convince the carrier to transfer the number. To do this, they may first comb through the victim’s social media and general web presence for personal identifiable information (PII). Then they use this information to convince the mobile carrier that they are, in fact, the victim.
• Insider threat tactics, in which they bribe someone who works at a mobile carrier to conduct the number transfer for them.
• Phishing, in which they send emails containing malware to mobile carrier employees. In other cases, they may also use phishing techniques to collect PII about their victims. 

The actual swapping of SIM numbers is only the beginning of the fraud. Once the criminals successfully transfer your number to their device, they turn to your various financial accounts. By initiating password-reset or account-recovery processes, the FBI explains, they use two-factor authentication to have new passwords or recovery links sent to your number—which, of course, they now have control over. This enables them to log in to your financial accounts, including any crypto accounts, and steal your funds. 

Ways To Prevent SIM Swapping

There are a number of important steps you can take to prevent SIM swapping attacks. Perhaps the most important is maintaining good digital hygiene. As the FBI advises, you should avoid publicizing your financial holdings online. Iif you boast about crypto accounts on social media, hackers might identify you as a potential target. The same goes for other personal identifying information that hackers could use to impersonate you. This includes your birthdate, phone number, address, and any past addresses. 

Other essential risk-mitigation measures include:

• Where possible, use your email address instead of SMS/text for accounts that use two-factor authentication. Some services may also allow you to use an authentication app that provides a onetime login code.
• Use a variety of different passwords for your online accounts. The more complex, the better.
• Do not respond to any emails that solicit personal identifying information. 
• If someone from your other financial institution calls asking for PII, hang up and call an official customer service line. Ask the institution whether they made the previous call; if they didn’t, consider placing an alert on your accounts.
• If your mobile carrier requires a PIN to conduct SIM swaps, use a complex number or passphrase. Steer clear of easy-to-guess passcodes, like your birthdate or your name. Do not post this PIN online. 

Does the AT&T Hack Put me at Risk of SIM Swapping?

The AT&T hack disclosed in July 2024 involved records for more than 100 million AT&T customers, including their phone numbers and in some cases the numbers they interacted with. This incident placed AT&T customers at risk of various forms of malicious activity, including SIM swapping. 

Victims of the hack should be vigilant of the red flags of SIM swapping. The most obvious is that your phone suddenly has no service. If you can’t send or receive messages or make calls, it’s possible that hackers have conducted a SIM swap on your phone. 

In some cases, you may also receive notifications of suspicious activity in your financial accounts. If you suspect a SIM swap might be in progress, you should always try to log in to other accounts to check whether you still have access. If you don’t—or if you receive notifications about account transfers you didn’t make—you are likely in the midst of a hack. 

Can I Sue My Mobile Carrier If I’ve Been SIM Swapped?

If you are an AT&T customer who lost money as part of a SIM swap, you may be able to sue your mobile provider. Call MDF Law at 800-767-8040 today for a free consultation.