Data Security Breach Cost AT&T $25 Million
Everyone was surprised that the U.S. Federal Communications Commission (FCC) fined AT&T $25 million dollars for a customer data protection failure. No company was ever fined such a large sum for violating data security laws. This fine was imposed several months after the data was lost in and near Mexico, May 2014. The data contained confidential information, such as their customer names, security credentials and other private information. There were data breaches between November 2013 and April 2014, they occurred at call centers in the Philippines, Mexico and Colombia.
The breach affected around 280,000 subscribers. The data was sold to phone thieves, the thieves needed this information so they can unlock stolen phones. The cause of the security breach was the misuse of the company’s credentials by employees within the call centers. The employees must of used the company’s logins to get customers’ personal information and then sold them to the phone thieves. Two employees confessed to being a part of these breaches and that they gave the data over to a third-party member named "El Pelon" (Spanish for Bald Man).
Although AT&T were not directly involved in the breach, the FCC decided to fine them for this violation of data security laws. The breach occurred within one of their contract company that were to provide Spanish language customer support. AT&T is currently trying to reaffirm trust in the company and to make sure that their customers will not too affected by this breach. All existing contracts and agreements with the contract company have been terminated because of the breach. AT&T is taking steps to assure that this never happens again, they are updating their policies which are said to be more secure than ever.
The FCC must of fine AT&T to discourage companies making contracts with other companies without thoroughly checking them and their security throughout the time period of their contract, but $25 million seems a bit too much. Companies like AT&T must monitor all accounts that are being handled by contract companies to make sure that there are no security violations taking place. Hopefully the changes that AT&T made to their policies make their systems more secure and that they are more careful about who they signed contracts with.
[SOURCE] ~ (April 14, 2015)















