
The data breach at AT&T impacted nearly all of its wireless customers, which is approximately 110 million people. The breach exposed phone records including call and text message logs, but did not include the content of the calls or texts, nor personal information such as Social Security numbers or dates of birth.

The AT&T breach involved the theft of phone records of "nearly all" of its customers, including records of calls and texts, the total count of calls and texts, and call durations for a six-month period between May 1, 2022, and October 31, 2022. For some customers, cell site identification numbers linked to phone calls and text messages were also stolen. However, the stolen data did not include the content of calls or texts, their time or date, or personal information such as Social Security numbers, birth dates, or other personally identifiable information.

AT&T delayed the breach disclosure to the public because the Justice Department requested it due to concerns about national security and public safety3. The delay was to allow law enforcement to investigate the incident and try to apprehend those responsible.