AT&T pays threat actor $370,000 to delete stolen data – media

The multinational telecommunications company reportedly paid hackers almost $400,000 to delete the data stolen from nearly all AT&T customers.

AT&T reportedly employed a hacker to delete the tens of millions of call, text, and landline data that was stolen from the company, affecting nearly all of its customers.

The hacker supposedly provided video evidence showing that the stolen data had been deleted, according to Wired’s latest report.

The company communicated through another hacker known as Reddington, who represented a threat actor from the hacking gang ShinyHunters.

Reddington alleges that the video evidence provided by the hacker shows that the only copy of AT&T’s stolen data has been deleted.

AT&T ended up paying the ShinyHunters threat actor $370,000 to delete the data – the ransom was originally set at $1 million. Reddington was reportedly also paid for their part in the deal.

On May 17th, 2024, The company paid 5.7 Bitcoin, which was $373,646, Wired confirmed the transaction through an online blockchain tracking tool.

Reddington claims to have corresponded with a number of other companies on behalf of the hacking group.

AT&T isn’t the first company to be compromised via ill-secured Snowflake accounts.

Ticketmaster and Santander are among the alleged 150 companies that have suffered the same fate.

Former NSA hacker, and Faculty at IANS Research, a Boston-based cybersecurity firm Jake Williams said he has a hard time blaming Snowflake for the breaches.

"They had to balance customer adoption with ease of use and didn't force users to employ stronger security settings. But those more secure configuration options were available. This is akin to a car in the 80s that had seat belts but no alarm for unbuckling. If the manufacturer provided a safety option you chose not to use and you get hurt, whose fault is it?," Williams said.