Understanding the impact of data breaches on consumers and companies.
Over the Easter holiday, AT&T quietly admitted that a data breach had leaked the personal information of 73 million customers. If the Dallas, Texas-based telecommunications giant was trying to bury the bad news over a busy weekend, it didn’t work, as news of the breach made international headlines.
The information appeared to be from 7.6 million current AT&T account holders and another 65.4 million former account holders. In a press release, AT&T said they had determined that data including full names, email addresses, mailing addresses, phone numbers, Social Security numbers, dates of birth, account numbers, and four-digit passcodes were leaked.
On the bright side, AT&T said the leaked information was all from 2019 or earlier and did not include financial information or call history. On the other hand, all the information had reportedly spent two weeks circulating on the dark web.
The company said a robust investigation was underway, supported by internal and external cybersecurity teams. AT&T automatically reset passwords for the 7.6 million current account holders impacted, and as of press time, no evidence of unauthorized access to any accounts had emerged. As most companies do in the wake of a data breach, AT&T also offered free credit monitoring to all those affected.
It’s another big blow for AT&T, whose 5G network covers 290 million people in the United States. In February, that network experienced a day-long outage that disrupted calls and text messages for thousands of U.S. users and prompted federal investigations. In March 2023, AT&T also notified roughly 9 million wireless customers that their customer proprietary network information (CPNI) was compromised in a data breach at a third-party vendor.
How can consumers protect their information?
Updating passwords and strengthening login protocols are good first steps. Security experts recommend passwords that mix letters, numbers, symbols, and special characters. A 12-character-long password like that would take 226 years for hackers to crack—and an 18-character-long version would take trillions of years to crack.
If you have old passwords that consist of only numbers or letters, update them immediately—they’re the most vulnerable. Use a memorable core phrase surrounded by unique letters or numbers that are unique to the account, app, or platform. Avoid using publicly identifiable personal facts like a pet’s name or your child’s birthday in your password.
Next, implement multi-factor authentication for every app that offers it. MFA is an authentication method that requires a user to combine something they know (a password) with something they have (a unique code delivered via text or email, or a push notification to a mobile device). After that’s in place, single sign-on (SSO) streamlines the login process with a centralized app that requires just one password and one MFA prompt to grant access to multiple business applications.
What comes next after those three steps?
Stronger passwords paired with MFA and SSO tools aren’t cure-alls for cybersecurity issues. CMIT Solutions recommends the following strategies so that cybersecurity protection can actually make a difference:
• Protect all the devices in your network. Many businesses think that securing office computers is adequate. But every device—laptops, smartphones, tablets, printers, servers, and even Wi-Fi routers—should be protected, especially in the current hybrid work environment. Rather than only prioritizing certain machines or certain employees, comprehensive device security protects against a multitude of threats: malware and ransomware, data hacks and breaches, email-borne viruses, and operating system vulnerabilities.
• Add more layers of protection. The “umbrella” approach to cybersecurity also includes extra solutions: firewalls, software updates, security patches, end-to-end data encryption, content filtering, and network analysis, along with advanced antivirus, anti-spam, and anti-malware protection. The goal of this kind of package is to place as many obstacles in the way of potential hackers who might try to exploit a specific vulnerability to steal information.
• Check to see if IT support is available around the clock. Depending on where your business is located and what industry it operates in, 24/7 monitoring and maintenance might be necessary. This is especially true if you have employees working in multiple time zones, sensitive communications that need to be regularly encrypted, or e-commerce running around the clock. The best IT provider will have multiple offices staffed by rotating shifts of technicians, all working to keep companies safe no matter when or where their operations occur.
• Make sure compliance requirements are met. HIPAA, GDPR, and PCI are more than just annoying acronyms. With state, federal, and industry regulations in place across the U.S. and Canada, businesses in sensitive industries like healthcare, finance, and legal services must be smart about how data is shared—especially since non-compliance can lead to serious civil or even criminal penalties. Robust cybersecurity protection should come with compliance checks at every level to keep your business in line with government and industry rules.
• Back up data regularly, remotely, and redundantly. One of the smartest ways to protect your business is with reliable data backups that can be accessed in case of information loss. Without these trusted backups in place, many companies affected by viruses or ransomware could have to pay thousands of dollars to try and retrieve their data from cybercriminals. But storing data in multiple locations means that lost information can be quickly recovered from its latest backup point and reinstalled before negative consequences occur.
• Provide employees with regular education and training. The only thing as important as properly functioning technology is the knowledge of the people operating those devices to do their day-to-day work. Truly responsive support should include ongoing education that empowers your employees to identify spam emails, understand the way ransomware works, encrypt communications on all channels, and back up data regularly. This can help to mitigate the most common security risk of all: unintended human error.
CMIT Solutions is committed to helping businesses of every size prepare for and protect against data breaches, information hacks, ransomware infections, and other cyberthreats. We work with organizations of all sizes across North America to defend their data, secure their networks, and empower employees to work productively and efficiently.
If you’re worried about the ongoing threat of information loss or want to enhance the protection of your data and devices, contact CMIT Solutions today. We’re here to help in the wake of breaches and leaks—and to make sure they don’t happen next time.