On 12 July 2024 AT&T disclosed that records of calls and texts covering approximately 110 million customers had been taken from its Snowflake environment. The records were metadata: which number contacted which number, and how often.
No message content was involved and the company said the data did not contain names. Both statements are true and neither is reassuring.
Metadata Is Not A Lesser Category
A number is not a name until somebody looks it up, and looking it up is trivial. What the set actually contains is a contact graph: who a person calls, at what hours, and how that pattern changes.
For most people that is uninteresting. For a journalist’s sources, a domestic abuse survivor, a person seeking treatment, or anybody whose safety depends on an association not being known, it is the most sensitive thing a telecom holds.
The Corpus Has No Way To Grade This
Severity here is assigned by volume and by data type, and both instruments read metadata as low. A file recording 110 million contact graphs and a file recording 110 million email addresses come out at similar severity, which is plainly wrong and is a limitation of the scale rather than a judgement.
This desk records that as a defect in its own method rather than resolving it, because a severity scale that weighted metadata correctly would need to know who the affected people are, and no such scale exists.
It Reached This Database Because Of Who Lost It
A listed carrier with a securities obligation and a regulator disclosed. The corpus set out at 25-0924b that a listing is one of the routes by which an incident becomes public, and this is a clean instance of it.
The same records held by a smaller operator in a jurisdiction without a notification regime would have produced nothing at all.
Compiled from the company’s disclosure and contemporaneous reporting, listed below. Graded high: the disclosure originates with the company. The figure of approximately 110 million customers is as reported. The argument about metadata sensitivity is this desk’s and is offered as an argument, not a finding about harm to any individual. Corrections: corrections@forensicpost.com.