Re: Did AT&T leak their email list publicly?

#1

Post by patneedham » Tue, Sep 05, 2023, 9:09 PM UTC

I'm apparently on this list: DONOTUSEPOD1NON@list.att.com

Here are some screenshots of the debacle [edit: properly redacted now]

https://imgur.com/a/MWV2wmk

https://imgur.com/a/yRJCKUn

It started out when someone wrote to that mailing list with

> This is a test to see if external users can email AT&T's internal email list with the most recent email mishap.

followed by other responses like

> I guess so…

> So far, based on the number of unique domains coming back directly to me (and replying all), it appears to be mostly business customers. I am assuming business because I also used my gmail for my business when I set up an AT&T account. Time will tell of course but there's definitely not an insignificant number of people on this list as far as I can tell.

> We’re just lucky there aren’t multiple people with vacation responses on eh?

Re: Re: Did AT&T leak their email list publicly?

#2

Post by mattl » Tue, Sep 05, 2023, 9:10 PM UTC

How many unique addresses on the list approximately?

Re: Re: Did AT&T leak their email list publicly?

#3

Post by samstave » Tue, Sep 05, 2023, 9:14 PM UTC

That list will be sold for much coin soon.

Re: Re: Did AT&T leak their email list publicly?

#4

Post by patneedham » Tue, Sep 05, 2023, 9:27 PM UTC

mattl wrote: post #2

How many unique addresses on the list approximately?

No idea. The person who initially emailed that mailing list address said he'll write about it on his linkedin after the storm and after it's fixed. FWIW I'm not an AT&T customer (or business customer), I just happened to participate in some IOT hackathon they sponsored/hosted 6 or 7 years ago, that's the only way they've ever obtained my email address.

Only 9 unique email addresses have added to the "reply-all" thread within the past couple hours. Don't know if any estimates can be extrapolated from that though.

Re: Re: Did AT&T leak their email list publicly?

#5

Post by peddling-brink » Tue, Sep 05, 2023, 10:05 PM UTC

patneedham wrote: post #4

mattl wrote: post #2

How many unique addresses on the list approximately?

No idea. The person who initially emailed that mailing list address said he'll write about it on his linkedin after the storm and after it's fixed. FWIW I'm not an AT&T customer (or business customer), I just happened to participate in some IOT hackathon they sponsored/hosted 6 or 7 years ago, that's the only way they've ever obtained my email address. Only 9 unique email addresses have added to the "reply-all" threa…

You are leaking those addresses with your screenshots. You should remove or redact those.

Re: Re: Did AT&T leak their email list publicly?

#6

Post by proslasher » Tue, Sep 05, 2023, 10:12 PM UTC

Legit, I'm the OP of the first email. AMA.

No, they didn't leak the email list, but they did leak their internal email list and showed that the incompetently set up an exchange DL and allowed anyone to email it instead of a restricted set of users. They also didn't take the time to close it down, they instead deleted it.

If I wasn't the OP, I wouldn't know that John Hammond is making a video of this right now. Check back in a few hours when this comment ages like fine wine.

Re: Re: Did AT&T leak their email list publicly?

#7

Post by proslasher » Tue, Sep 05, 2023, 10:16 PM UTC

patneedham wrote: post #4

mattl wrote: post #2

How many unique addresses on the list approximately?

No idea. The person who initially emailed that mailing list address said he'll write about it on his linkedin after the storm and after it's fixed. FWIW I'm not an AT&T customer (or business customer), I just happened to participate in some IOT hackathon they sponsored/hosted 6 or 7 years ago, that's the only way they've ever obtained my email address. Only 9 unique email addresses have added to the "reply-all" threa…

yeah, I'll post it on my linkedin. If you gave me your email, I'll send a copy of the linkedin post after I post it, along with the survey stats.

Here's the preliminary data of those who've responded so far:

https://i.imgur.com/5dMMHyp.png

Re: Re: Did AT&T leak their email list publicly?

#8

Post by castratikron » Tue, Sep 05, 2023, 10:23 PM UTC

I got one too

Re: Re: Did AT&T leak their email list publicly?

#9

Post by proslasher » Wed, Sep 06, 2023, 1:54 AM UTC

proslasher wrote: post #6

Legit, I'm the OP of the first email. AMA. No, they didn't leak the email list, but they did leak their internal email list and showed that the incompetently set up an exchange DL and allowed anyone to email it instead of a restricted set of users. They also didn't take the time to close it down, they instead deleted it. If I wasn't the OP, I wouldn't know that John Hammond is making a video of this right now. Check…

Video will be up tomorrow.

Re: Re: Did AT&T leak their email list publicly?

#10

Post by patneedham » Wed, Sep 06, 2023, 7:28 AM UTC

peddling-brink wrote: post #5

patneedham wrote: post #4

Earlier quoted context omitted.

No idea. The person who initially emailed that mailing list address said he'll write about it on his linkedin after the storm and after it's fixed. FWIW I'm not an AT&T customer (or business customer), I just happened to participate in some IOT hackathon they sponsored/hosted 6 or 7 years ago, that's the only way they've ever obtained my email address. Only 9 unique email addresses have added to the "reply-all" threa…

You are leaking those addresses with your screenshots. You should remove or redact those.

Thanks for the suggestion (and thank you mods for making the update).