Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AT&T says criminals stole phone records of 'nearly all' customers in data breach

techcrunch.com

Post reply on HN
Print view View original

101–110 of 874 posts

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#101

Post by _heimdall »

mountainb wrote: post #80
akshayB wrote: post #7

The real problem is that data needs to be deleted over time. There is not much of a use case for customers for go back last year and see who called them and obviously there are use cases like criminal investigations or spying. But customer has no power or ability to dictate how long their records are store and how they are used. Companies should provide tools and features to their customers empowering them with their…

Non-murder criminal offenses typically have very short statutes of limitations. A lot of this could also be solved by encouraging the federal government to enforce federal privacy law as written more aggressively. A good incentive would be to amend the privacy statutes to permit the FTC to keep the funds extracted from settlements and penalties in-house. This would allow them to increase staffing and create a positiv…

> Non-murder criminal offenses typically have very short statutes of limitations.

There's a hidden assumption here. The expectation is that data retention and potential privacy violations are a necessary evil because anyone may later be under investigation for a crime. The data could go uncollected, it isn't AT&Ts job to retain private information on all of us just in case an investigator wants it.

Take telecoms out of it and consider a convenience store. Police would like to have video recordings of whatever moment in time they are investigating, but that doesn't mean the video has to be recorded and retained. A shop owner can choose to record videos and only retain them for a week if they want, or they can have cameras installed but not even recording if they're okay with just the effect of deterrence.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#102

Post by JohnMakin »

criddell wrote: post #78
JohnMakin wrote: post #19

So where/what is my compensation? (I know there is no recourse). When no one is on the hook for secure practices, like enabling MFA on your effin data stores that contain massive amounts of customer PII, this is the result. Not even an apology, just report it and move on. woops! those gosh darned cyber criminals.

If you go to court and ask for compensation you would likely be asked to show harm. Could you?

It really doesn’t matter. Compensation has been dispensed to customers in data breaches such as credit/ssn info, no harm proof needed. Potential for harm is enough. Breach of contract, as a customer do I have a reasonable expectation that this data is not exposed? of course I do. No one could very seriously argue it’s a zero sum.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#103

Post by ghaff »

criddell wrote: post #92
jen20 wrote: post #15

This is the kind of breach that really should be company-ending, but will sadly instead likely result in a slap on the wrist. It is high time for the US to have a privacy law with real teeth, and to enforce it with vigour.

Or maybe it's time to turn software engineering into an actual engineering profession. If the people responsible for designing and maintaining the AT&T system were "real" engineers, they could be sued for malpractice or even lose their license to practice.

Do you really think that requiring 4-year degrees and passing a licensing exam would make a big difference? The fact is that, outside of civil engineering which involves a lot of dealing with regulatory agencies, most engineers in the US don't have PEs. I started on the path to get one because, had I stayed on my initial career path, I'd have been sending blueprints etc. to regulatory agencies but I ended up changing careers.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#105

Post by strangecharm2 »

rybosworld wrote: post #12

Consumers are so numb to data breaches that these events now bring very little outrage. I think without that anger from the consumer, there's little incentive for companies to do more to stop data breaches from happening.

And why didn't they do anything when we WERE angry?

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#106

Post by [deleted] »

mountainb wrote: post #80
akshayB wrote: post #7

The real problem is that data needs to be deleted over time. There is not much of a use case for customers for go back last year and see who called them and obviously there are use cases like criminal investigations or spying. But customer has no power or ability to dictate how long their records are store and how they are used. Companies should provide tools and features to their customers empowering them with their…

Non-murder criminal offenses typically have very short statutes of limitations. A lot of this could also be solved by encouraging the federal government to enforce federal privacy law as written more aggressively. A good incentive would be to amend the privacy statutes to permit the FTC to keep the funds extracted from settlements and penalties in-house. This would allow them to increase staffing and create a positiv…

[deleted]

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#107

Post by chung8123 »

jader201 wrote: post #84
smcin wrote: post #70

AT&T stock has already bounced back from much of the initial -2.6% drop this morning, so the market thinks AT&T is immune. Meanwhile Snowflake is -3.9% down (they have many other customers than AT&T). https://www.marketwatch.com/investing/stock/T https://www.marketwatch.com/investing/stock/SNOW

I never got the impression that the market ever cares about data breaches. It seems most companies are rarely held financially responsible for data breaches anyway. I would bet any effects you’re seeing in stocks is unrelated to this news.

I think they will care a lot more when it directly impacts them. If all their text conversations were publicly available that would cause some outrage.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#108

Post by ThunderSizzle »

ajsnigrutin wrote: post #96
pylua wrote: post #75

And earlier this year my ssn was on the dark web due to their leak (or vendor). One year of monitoring? No, I’m going to need it for life. Security is not a concern. There is no real incentive to change the status quo. Make them pay for monitoring indefinitely .

I never understood the american secrecy about SSN... it should be a "username" not a "password"... In my country you can calculate our own national id (mix of date of birth, autoincreasing number by each birth that day + 1 checksum number), and if you do/have any kind of personal business, your personal tax number has to be written everywhere, on every receipt you hand out or anything you buy as a business. Somehow k…

SSN is too public for it to be private or secret. Multiple employers, schools, medical institutions, financial institutions all ask for it, so it's not private.

It's also treated as evidence of who you are, but it isn't tied to identification like an ID is. These institutions use it without ever truly validating it.

It's similar to how records fraud can occur - people can record anything to the local registrar office, including fraudulent documents, without any checks. Once it's registered, it becomes evidence against the real owner. It's really messed up.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#109

Post by strangecharm2 »

ajsnigrutin wrote: post #96
pylua wrote: post #75

And earlier this year my ssn was on the dark web due to their leak (or vendor). One year of monitoring? No, I’m going to need it for life. Security is not a concern. There is no real incentive to change the status quo. Make them pay for monitoring indefinitely .

I never understood the american secrecy about SSN... it should be a "username" not a "password"... In my country you can calculate our own national id (mix of date of birth, autoincreasing number by each birth that day + 1 checksum number), and if you do/have any kind of personal business, your personal tax number has to be written everywhere, on every receipt you hand out or anything you buy as a business. Somehow k…

This comment pops up every time someone talks about social security numbers. Yes, they were never supposed to be private, but now they are. So either Congress can do something about it, or big companies can stop leaking them. Clever "well, actually"s didn't stop my identity from being stolen recently after a breach, and they never will.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#110

Post by demondemidi »

pylua wrote: post #75

And earlier this year my ssn was on the dark web due to their leak (or vendor). One year of monitoring? No, I’m going to need it for life. Security is not a concern. There is no real incentive to change the status quo. Make them pay for monitoring indefinitely .

When I went to college in the late 80s my ssn was automatically used as my student id. When I got my first bank account in 1990, they used my ssn as the account number.
Post reply on HN