Hackers compromised six months' worth of call and text message records from nearly every AT&T cellular network customer, as disclosed by the company on Friday, raising significant concerns about the potential exposure of sensitive information affecting millions of Americans.

In a filing with the SEC, AT&T revealed that hackers gained unauthorized access to and copied call logs stored on a third-party cloud platform in April. The breached data spans from May 1 to October 31, 2022, and includes records up to January 2, 2023. Although the content of communications remained secure, the stolen records contain phone numbers, considered metadata, which can be highly sensitive when aggregated and analyzed at scale to discern patterns and connections between individuals.

AT&T's expansive wireless network serves approximately 127 million devices, underscoring the scale and potential impact of the breach, despite the absence of customer names in the compromised data. AT&T acknowledged the possibility that publicly available tools could potentially link phone numbers to individuals.

Prompted by the severity of the incident, law enforcement agencies, including the Justice Department, FBI, and FCC, have initiated investigations. John Scott-Railton from the University of Toronto's Citizen Lab described the breach as a "megabreach," highlighting its potential as a significant national security threat and a major concern for businesses and individuals alike, drawing parallels to past revelations about metadata collection.

Thomas Rid, a cybersecurity expert at Johns Hopkins University, emphasized the invasive nature of metadata, which can divulge intimate details about individuals' daily lives. AT&T stated it has bolstered its cybersecurity measures to prevent further unauthorized access and committed to notifying affected customers promptly.

While AT&T assured the public that the stolen data is currently not believed to be publicly accessible, the company reassured stakeholders that the incident would not disrupt operations or adversely impact financial results.

This breach follows a previous security incident earlier this year where some AT&T customer names and Social Security numbers were exposed, compounding risks for affected customers, according to Jake Williams from Hunter Strategy.

Senator Ron Wyden criticized the telecommunications industry's cybersecurity standards, advocating for stricter oversight by the FCC to enforce stronger protections for customer data. He emphasized that without substantial penalties for negligent companies, data breaches like AT&T's will continue to pose threats to customer privacy and security.