Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AT&T says criminals stole phone records of 'nearly all' customers in data breach

techcrunch.com

Post reply on HN
Print view View original

771–780 of 874 posts

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#771

Post by hedora »

highwaylights wrote: post #765
whyenot wrote: post #416

AT&T has 110 million customers. Let's be optimistic and assume that each customer only has to spend one minute of extra time managing their account due to the break-in. That is more than 209 years of lost time. Laws related to data breaches need to have much sharper teeth. Companies are going to do the bare minimum when it comes to securing data as long as breaches have almost no real consequences. Maybe pierce the c…

Genuinely chonky fines seems to be the answer to this problem, as it aligns incentives with rewards/penalties (if you’re lax about how your company approaches user data then you’ll be at financial risk). Piercing the veil to prosecute those “responsible” seems like it would just incentivise the business to carry on as normal but with employees that are contractually designated (i.e. forced) to be fall guys if anythin…

If PG&E has taught us anything, utility companies can literally blow up and burn down cities and no amount of fines or paying for the damages done will matter to them.

Monopolies can always just pass the cost of the fine to their customers.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#772

Post by abdullahkhalids »

mr_toad wrote: post #679
abdullahkhalids wrote: post #492

Earlier quoted context omitted.

The correct way is to follow what all other engineering and trade (medicine/law) already follow. Some software engineers are licensed. A company must hire these software engineers, and any changes to what data is saved or how is saved must be signed by these engineers. If a breach occurs, an investigation occurs and if these licensed software engineers are found to be negligent, they lose their license. If they are f…

Where do you draw the line? Does that mean you need a license to write Excel formulas?

The license is only for protection of user personal data - names, dob, address, id documents data, credit card data etc, and not, say, how many upvotes you have on HN. The vast majority of sites and software do not need to store any of this data. And the vast majority of code that is written has nothing to do with user personal data.

The larger legal change has to happen is

1. Do not store user personal data if you don't have to (EU already has laws about it)

2. If you store user personal data, you have to guarantee up front that it is stored and processed in a safe way (what I am suggesting). Of course, exception can be made for sites/software with small number of users, or give some time bound leeway, so startups can grow before having to hire a licensed engineer.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#773

Post by declan_roberts »

djbusby wrote: post #413
declan_roberts wrote: post #406

I would like to sue AT&T in small claims for this and for leaking my Social Security number. But it's difficult to prove damages in these situations. Does anybody have any advice? Proving damages means showing actual monetary harm.

And look for Arbitration clause in your contract. Might limit your options.

I was not a customer with AT&T when they leaked my Social Security number.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#774

Post by ikekkdcjkfke »

abdullahkhalids wrote: post #492
whyenot wrote: post #416

AT&T has 110 million customers. Let's be optimistic and assume that each customer only has to spend one minute of extra time managing their account due to the break-in. That is more than 209 years of lost time. Laws related to data breaches need to have much sharper teeth. Companies are going to do the bare minimum when it comes to securing data as long as breaches have almost no real consequences. Maybe pierce the c…

The correct way is to follow what all other engineering and trade (medicine/law) already follow. Some software engineers are licensed. A company must hire these software engineers, and any changes to what data is saved or how is saved must be signed by these engineers. If a breach occurs, an investigation occurs and if these licensed software engineers are found to be negligent, they lose their license. If they are f…

Are there any other analogies around 'endangering', because that's what happens when this info leaks to criminals

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#775

Post by bastawhiz »

mozman wrote: post #708
bastawhiz wrote: post #641

Earlier quoted context omitted.

Being required to do something doesn't justify doing it poorly. AT&T brought in over $3 billion with a B of profit with a P in Q1 2024. They have more than enough money to secure their systems. They're not struggling. In March of this year they bought back 157M of their stock. They could have instead put that money towards security, but they didn't: they put it towards enriching shareholders.

Enriching shareholders is exactly what they are required to do. What, nobody is allowed to make money anymore?

Sure, and then it's the government's job to ensure the shareholders lose their money when the company loses a hundred million customers' records. So yeah, it turns out that when you pay yourself instead of doing right by your customers, I think you shouldn't be allowed to make a profit.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#776

Post by Johnny555 »

1vuio0pswjnm7 wrote: post #694
whyenot wrote: post #416

AT&T has 110 million customers. Let's be optimistic and assume that each customer only has to spend one minute of extra time managing their account due to the break-in. That is more than 209 years of lost time. Laws related to data breaches need to have much sharper teeth. Companies are going to do the bare minimum when it comes to securing data as long as breaches have almost no real consequences. Maybe pierce the c…

The breach here was not against AT&T but against a cloud computing company called Snowflake. Cloud computing companies, so-called "tech" companies, and the people who work for them, including many HN commenters, advise the public to store data "in the cloud". They encourage the public, whether companies or individuals, to store their data on someone else's computer that is connected to the open internet 24/7 instead…

>The breach here was not against AT&T but against a cloud computing company called Snowflake.

It wasn't really a Snowflake breach, if it's like the other Snowflake data leaks, AT&T didn't set up MFA for a privileged account and someone got in with a password compromised by other means. For smaller companies I'd be willing to put more blame on Snowflake for not requiring MFA, but AT&T is large enough to have their own security team that should know what they are doing.

This is yet another wakeup call for all companies - passwords are not secure by themselves because there are so many ways for passwords to be leaked. Even though SMS MFA is weak, it's far better than a password alone.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#777

Post by fauigerzigerk »

chasd00 wrote: post #747
bastawhiz wrote: post #641

Earlier quoted context omitted.

Being required to do something doesn't justify doing it poorly. AT&T brought in over $3 billion with a B of profit with a P in Q1 2024. They have more than enough money to secure their systems. They're not struggling. In March of this year they bought back 157M of their stock. They could have instead put that money towards security, but they didn't: they put it towards enriching shareholders.

It was snowflake’s lack of security that did this not ATT. Not saying ATT is a paragon of security or anything but snowflake was where the hack took place.

What do you know about Snowflake's role in this? According to the article, Snowflake says that they offered 2FA and AT&T didn't use it.

Perhaps that's not the whole story, but if true then blame certainly lies with AT&T to a significant degree.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#778

Post by wrs »

chasd00 wrote: post #747
bastawhiz wrote: post #641

Earlier quoted context omitted.

Being required to do something doesn't justify doing it poorly. AT&T brought in over $3 billion with a B of profit with a P in Q1 2024. They have more than enough money to secure their systems. They're not struggling. In March of this year they bought back 157M of their stock. They could have instead put that money towards security, but they didn't: they put it towards enriching shareholders.

It was snowflake’s lack of security that did this not ATT. Not saying ATT is a paragon of security or anything but snowflake was where the hack took place.

Snowflake has the same shared-responsibility structure as any other cloud provider: they provide enforcement but you are responsible for setting up and protecting your own credentials and permissions. They can’t impose “security” unilaterally in the abstract.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#779

Post by renegade-otter »

matthewdgreen wrote: post #731
renegade-otter wrote: post #711

Earlier quoted context omitted.

They added windows to this now, but I always wondered what this windowless skyscraper was, back in the day, in Downtown NYC. https://nymag.com/intelligencer/2016/11/new-yorks-nsa-listen...

That’s the AT&T Long Lines Building. It probably did have an NSA surveillance closet, but it wasn’t built without windows for that reason. The story I was told (by older colleagues when I worked at AT&T Labs) was that it was built during a time when riots and street violence were more common, so the fortress appearance was to ensure the city could maintain long-distance connectivity during urban unrest. I believe the…

Perhaps, but the other version would explain the "nuclear-war-proof" thing.

I am sure the employees were told SOME kind of legend, because that building begs questions.

Re: AT&T says criminals stole phone records of 'nearly all' customers in data breach

#780

Post by ASalazarMX »

arcticbull wrote: post #497
ASalazarMX wrote: post #467

Earlier quoted context omitted.

It's a good business decision to make others do your work.

Government is not a business!

USA government sure looks like a business from several angles.
Post reply on HN