AT&T says criminals stole phone records of 'nearly all' customers in data breach • Hacker News Board

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#641

Post by bastawhiz » Sat, Jul 13, 2024, 2:54 AM UTC

trompetenaccoun wrote: post #575

whyenot wrote: post #416

AT&T has 110 million customers. Let's be optimistic and assume that each customer only has to spend one minute of extra time managing their account due to the break-in. That is more than 209 years of lost time. Laws related to data breaches need to have much sharper teeth. Companies are going to do the bare minimum when it comes to securing data as long as breaches have almost no real consequences. Maybe pierce the c…

It surprises me that there isn't a single comment pointing out that corporations like AT&T don't collect all that data for fun. This actually costs them a lot of money, but they're legally required by the government. While everyone is blaming the company, did you not take a second and contemplate how weird it is that you're fine with the government (and now everyone else es well) getting a record of all your phone ac…

Being required to do something doesn't justify doing it poorly. AT&T brought in over $3 billion with a B of profit with a P in Q1 2024. They have more than enough money to secure their systems. They're not struggling. In March of this year they bought back 157M of their stock. They could have instead put that money towards security, but they didn't: they put it towards enriching shareholders.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#642

Post by Liquix » Sat, Jul 13, 2024, 2:54 AM UTC

r3trohack3r wrote: post #582

Reading the articles about this breach and the nature of the data in this Snowflake lake, I personally wouldn’t consider this breach a “leak” from the customer perspective - to me the leak is upstream of this breach. Given the nature of the data in the database and the platform it was stored in, it seems extremely likely this data was not meant to be used internally by AT&T but was instead meant to be used externally…

That's the issue with dragnet data collection and Snowflake-esque databases - it's never safe to enter any personal information on the internet. Given enough time, any and all of it will be "shared" and used for a third party's financial/political gain.

Doesn't matter if it's AT&T, a bank, or the government. Never under any circumstances can you expect anything sensitive to stay private. This used to be taught as gospel when introducing kids to the internet - it's crazy how much things have changed in 20 years.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#643

Post by steelframe » Sat, Jul 13, 2024, 2:56 AM UTC

lolinder wrote: post #614

zarathustreal wrote: post #612

Earlier quoted context omitted.

I’m baffled that anyone is even asking the question.. Anyone reading this, if you are of the “well the employee whole typed the command is to blame!” opinion, could you please reply to this comment? I need to know what you think the purpose of a hierarchy is in the workplace. ..needless to say, responsibility for your direct reports is yours. If they fuck up, you fucked up. You have the choice to hire and fire at wil…

It's a rhetorical question that's effective because the answer is obvious.

You would think so, but one time an undergraduate IT guy in my school's computer lab essentially ran an `rm -rf` on all the students' home directories 2 weeks from the end of the semester. It turns out the lab's backups weren't working. The email from the department was pretty quick to throw that kid under the bus.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#644

Post by nazgul17 » Sat, Jul 13, 2024, 2:58 AM UTC

simfree wrote: post #636

hluska wrote: post #609

Earlier quoted context omitted.

Why they hold it and how they protect it are valuable conversations. But their customers deserve something akin to security regardless of the why.

Spam mitigation and management is a huge bugaboo in wireless networks today. The big three wireless carriers in the USA today formed a cartel called The Campaign Registry that seeks out TINs/EINs and the SSNs of the owners of Sole Proprietorships and LLCs as part of a lengthy approval process to be allowed to send texts. It's a great extra judicial rent seeking machine that bans any SHAFT content (sex hate alcohol, t…

Tangent, but it's ridiculous that sex is in the same group of undesirables such as firearms, alcohol, tobacco and hate.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#645

Post by bastawhiz » Sat, Jul 13, 2024, 3:00 AM UTC

lumb63 wrote: post #549

whyenot wrote: post #416

AT&T has 110 million customers. Let's be optimistic and assume that each customer only has to spend one minute of extra time managing their account due to the break-in. That is more than 209 years of lost time. Laws related to data breaches need to have much sharper teeth. Companies are going to do the bare minimum when it comes to securing data as long as breaches have almost no real consequences. Maybe pierce the c…

The people “whose negligence made this possible” are probably just rank-and-file employees. Careful what you wish for. I know I sure wouldn’t want to be legally liable if my software were vulnerable to something I didn’t know about. Maybe a reasonable first step is third-party standards, audits, and certifications around data security to make privacy- and security-conscious consumers aware of what a company is doing.…

AT&T bought back a ton of shares of its own stock in March. It's likely that shareholders won't feel the effect of this security breach because of those buybacks (over a medium term time window).

How about instead of even more meaningless standards without teeth that don't affect the people pushing for profits over essentials like security, regulators impose punishments that actually affect the investors that ultimately create these perverse incentives in the first place? Nobody should be profiting off of a company that does wrong by over a hundred million people.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#646

Post by steelframe » Sat, Jul 13, 2024, 3:11 AM UTC

xyst wrote: post #222

0cf8612b2e1e wrote: post #166

Earlier quoted context omitted.

As a nobody, I keep wanting a financial product that is a black hole. Money can go in, but cannot come out without significant pain. Seven+ day waiting period, in person visit, physical mail verification, something, anything that means if I do get hacked my accounts are not drained in milliseconds. When I need a legitimate large withdrawal, I can go through the required effort.

This already exists. Withdraw from account to physical cash. Proceed to stash cash in “secret” location. Most businesses don’t even accept cash anymore. Can’t get “hacked” although it’s prone to many other issues — space, humidity, physical theft.

> Most businesses don’t even accept cash anymore.

Really? I've been using cash almost exclusively for the past several months and haven't had any real problems. Sure, the overpriced hipster vegan Thai place in the McMall district may not take cash, but the family-owned ramen restaurant a couple miles down the road is more than happy to do so. Personally I find the "won't take cash" attribute to be a strong indicator that the business isn't worth supporting.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#647

Post by 0xcde4c3db » Sat, Jul 13, 2024, 3:17 AM UTC

trompetenaccoun wrote: post #575

whyenot wrote: post #416

AT&T has 110 million customers. Let's be optimistic and assume that each customer only has to spend one minute of extra time managing their account due to the break-in. That is more than 209 years of lost time. Laws related to data breaches need to have much sharper teeth. Companies are going to do the bare minimum when it comes to securing data as long as breaches have almost no real consequences. Maybe pierce the c…

It surprises me that there isn't a single comment pointing out that corporations like AT&T don't collect all that data for fun. This actually costs them a lot of money, but they're legally required by the government. While everyone is blaming the company, did you not take a second and contemplate how weird it is that you're fine with the government (and now everyone else es well) getting a record of all your phone ac…

I've never heard of this, and cursory web searches don't seem to be turning up anything relevant (although that's admittedly not saying much with the state of search lately). Can you explain how the law requires this level of data retention?

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#648

Post by Buttons840 » Sat, Jul 13, 2024, 3:19 AM UTC

timr wrote: post #635

jonahx wrote: post #578

Earlier quoted context omitted.

> The people “whose negligence made this possible” are probably just rank-and-file employees. Careful what you wish for. I know I sure wouldn’t want to be legally liable if my software were vulnerable to something I didn’t know about. This isn't what's being suggested. Higher ups set the incentive structures that result in dwindling security resources. If their ass is on the line, they will actually listen to the dev…

> Higher ups set the incentive structures that result in dwindling security resources. What if this isn't the problem at all? What if a company invests a huge amount in data security, but still gets owned? That happens all the time. I don't understand why people leap to the conclusion that these events are inevitably the outcome of neglect. > If their ass is on the line, they will actually listen to the developers an…

Yeah, security checkboxes don't necessarily result in good security. One option is to still make companies liable for security breaches, regardless of what meaningless checkboxes they may have checked, and then trust that they'll figure it out. Real liability would shift things from theater to weighing actual risks and costs.

Another option is we can empower red teams (security researchers) to test the security of all systems even without permission, so long as they report their findings responsibly.

It's currently quite convenient for companies. They get to deny security researchers from testing their security, and they also have no liability if a security breach does happen. Or, to make it personal, if I want to investigate the security of a company by trying to hack their system, I risk going to jail, but if they lose my data in a breach I have no recompense.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#649

Post by simfree » Sat, Jul 13, 2024, 3:21 AM UTC

nazgul17 wrote: post #644

simfree wrote: post #636

Earlier quoted context omitted.

Spam mitigation and management is a huge bugaboo in wireless networks today. The big three wireless carriers in the USA today formed a cartel called The Campaign Registry that seeks out TINs/EINs and the SSNs of the owners of Sole Proprietorships and LLCs as part of a lengthy approval process to be allowed to send texts. It's a great extra judicial rent seeking machine that bans any SHAFT content (sex hate alcohol, t…

Tangent, but it's ridiculous that sex is in the same group of undesirables such as firearms, alcohol, tobacco and hate.

That T-Mobile is out here slapping spam mitigation blocks on phone numbers who received SHAFT content from numbers on T-Mobile's network is pretty ridiculous, but silently blocking and providing no appeal or escalation path is just how we let companies operate these days.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#650

Post by sp312tol » Sat, Jul 13, 2024, 3:26 AM UTC

trompetenaccoun wrote: post #575

whyenot wrote: post #416

AT&T has 110 million customers. Let's be optimistic and assume that each customer only has to spend one minute of extra time managing their account due to the break-in. That is more than 209 years of lost time. Laws related to data breaches need to have much sharper teeth. Companies are going to do the bare minimum when it comes to securing data as long as breaches have almost no real consequences. Maybe pierce the c…

It surprises me that there isn't a single comment pointing out that corporations like AT&T don't collect all that data for fun. This actually costs them a lot of money, but they're legally required by the government. While everyone is blaming the company, did you not take a second and contemplate how weird it is that you're fine with the government (and now everyone else es well) getting a record of all your phone ac…

> how weird it is that you're fine with the government getting a record of all your phone activity

I don't like it, but accept it as the lesser evil. I'm from Europe and I believe the number of reported prevented terror attacks. The agencies need data access for that. Not good, but necessary.

But are you aware that Meta, Google, Apple, MS, etc. collect every kind of information about every user of Android, iPhone or WhatsApp, Insta, Facebook, Windows? Phone manufacturer, huge apps like TicToc as well. The kind and size of that data is crazy beyond imagination. I don't care if the government can get access to my WhatsApp messages when some of the most irresponsible companies, collect and use everything to their advantage. Are you really that naive and think that Meta doesn't analyse their gigantic data lake including billions of WhatsApp messages to predict the results of elections? That is the real danger to democracy.