We review vendors based on rigorous testing and research but also take into account your feedback and our affiliate commission with providers. Some providers are owned by our parent company.
Learn more
vpnMentor was established in 2014 as an independent site reviewing VPN services and covering privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: ExpressVPN, CyberGhost, and Private Internet Access which may be ranked and reviewed on this website. The reviews published on vpnMentor are believed to be accurate as of the date of each article, and written according to our strict reviewing standards that prioritize the independent, professional and honest examination of the reviewer, taking into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings and reviews we publish may also take into consideration the common ownership mentioned above, and affiliate commissions we earn for purchases through links on our website. We do not review all VPN providers and information is believed to be accurate as of the date of each article.
Advertising Disclosure

vpnMentor was established in 2014 as an independent site reviewing VPN services and covering privacy-related stories. Today, our team of hundreds of cybersecurity researchers, writers, and editors continues to help readers fight for their online freedom in partnership with Kape Technologies PLC, which also owns the following products: ExpressVPN, CyberGhost, and Private Internet Access which may be ranked and reviewed on this website. The reviews published on vpnMentor are believed to be accurate as of the date of each article, and written according to our strict reviewing standards that prioritize the independent, professional and honest examination of the reviewer, taking into account the technical capabilities and qualities of the product together with its commercial value for users. The rankings and reviews we publish may also take into consideration the common ownership mentioned above, and affiliate commissions we earn for purchases through links on our website. We do not review all VPN providers and information is believed to be accurate as of the date of each article.

AT&T Informs 9 Million Customers of Data Breach

AT&T Informs 9 Million Customers of Data Breach
Keira Waddell Published on 15th March 2023 Senior Writer

AT&T has informed nearly 9 million customers that their information was compromised after a marketing vendor was hacked in January. The company has issued a breach notification that reveals that Customer Proprietary Network Information (CPNI) was exposed.

The data breach notification did not disclose the number of customers impacted, but AT&T told BleepingComputer that “approximately 9 million wireless accounts had their Customer Proprietary Network Information accessed.”

The CPNI data that was breached includes first names, wireless account numbers, wireless phone numbers, and email addresses. In some cases, impacted customers had their rate plan names, monthly payment amounts, past due amounts, minutes used, and various monthly charges exposed, although this information was several years old.

Thankfully, sensitive personal information like social security numbers, account passwords, or credit card details were not obtained by the hacker.

AT&T clarified that the vendor security incident did not compromise its systems, and the disclosed data was mainly associated with device upgrade eligibility. The company has duly notified federal law enforcement about the unauthorized access to customer data, as mandated by the Federal Communications Commission.

All AT&T customers have been advised to toggle off CPNI data sharing on their accounts. This can be done by making a CPNI Restriction Request, which should help reduce exposure risks from future third-party vendor hacks.

AT&T has not yet provided any information on which third-party vendor was breached for this data to be disclosed.

T-Mobile also disclosed a data breach this month that affected over 39 million of its customers. Similar to AT&T, the hacker didn’t gain this information by breaching T-Mobile’s internal systems. Instead, a vulnerability in an Application Programming Interface (API), was exploited by a threat actor for over a month before being detected and fixed by T-Mobile.

About the Author

Keira is an experienced cybersecurity and tech writer dedicated to providing comprehensive insights on VPNs, online privacy, and internet censorship.