AT&T Data Breach: 109 Million Customer Records Exfiltrated via Snowflake Cloud Campaign

Executive Summary

On July 12, 2026, telecommunications giant AT&T filed a formal disclosure with regulatory authorities regarding a massive data breach affecting approximately 109 million customer accounts. The compromised data includes records of calls and texts between May 2023 and October 2023, as well as a specific subset of records from early January 2024. The breach was facilitated through the unauthorized access of AT&T's data workspace hosted on the Snowflake cloud platform. While the content of messages and sensitive personal identifiers like Social Security Numbers were not reportedly taken in this specific incident, the metadata provides a detailed map of customer communications patterns, posing significant privacy and national security risks.

Threat Analysis

This incident is a significant escalation of the broader campaign targeting Snowflake customers, which has already impacted dozens of high-profile global organizations. The threat actors focus on extracting massive datasets from cloud storage environments to extort victims or facilitate secondary attacks. In the case of AT&T, the scale of the metadata—which includes phone numbers interacted with, the duration of calls, and tower identifiers—allows for sophisticated social engineering and potential de-anonymization of individuals through cross-referencing with other public data breaches. The ability to map social graphs is particularly valuable for espionage and targeted phishing.

Technical Details

Investigations by third-party intelligence firms suggest that the attackers, tracked as UNC5537, utilized credentials previously harvested by infostealer malware (such as Vidar, Raccoon, and Lumma) from non-corporate environments. These credentials allowed the actors to bypass perimeter defenses because the targeted Snowflake accounts lacked Multi-Factor Authentication (MFA). Once inside the Snowflake environment, the actors used legitimate administrative tools and the 'SnowSQL' command-line interface to automate the dumping of database tables into attacker-controlled storage. The exfiltration process was designed to blend in with normal administrative traffic, delaying detection for several months.

Attribution Assessment

Intelligence analysts attribute this campaign with high confidence to UNC5537, a financially motivated threat actor group. There is moderate confidence that the group includes members with ties to previous operations involving the 'Scattered Spider' ecosystem, though UNC5537 appears to operate as a distinct cell specializing in cloud-native data theft. Their tactics are characterized by extensive use of stolen credentials and a deep understanding of cloud database architectures, rather than the use of zero-day vulnerabilities.

Implications

The AT&T breach represents one of the largest telecom-related data thefts in history. The implications extend beyond consumer privacy; the call logs can be used by foreign intelligence services to map the social networks of government officials, corporate leaders, and law enforcement personnel. Furthermore, the success of this campaign underscores the critical vulnerability of 'MFA-less' service accounts in cloud environments and the persistent threat posed by the global infostealer ecosystem which feeds these large-scale intrusions.

Recommendations

Organizations utilizing cloud data warehouses must immediately enforce phishing-resistant MFA across all accounts, including service and administrative accounts. Encrygma recommends a thorough audit of all third-party cloud permissions and the implementation of network allow-lists to restrict access to known corporate IP ranges. Additionally, organizations should monitor for unauthorized use of data export commands and rotate any credentials that may have been exposed through historical infostealer infections on employee or contractor devices. Regular threat hunting within cloud logs for unusual bulk data movement is essential.