AT&T Breach Exposed Call Logs of 109 Million Customers

A 2024 breach at AT&T exposed communication logs belonging to 109 million current and former customers, according to the source. The records included phone numbers, call and text counts, call durations, and location data from May to October 2022 and January 2023. AT&T said the data did not include call content, customer names, or Social Security numbers.

Call metadata can still reveal sensitive patterns, including a person’s relationships, home and workplace, and daily routine. The source cites researcher Malte Spitz, who sued his telecom provider in 2011 for data it held about him. He received roughly 35,000 records and used them to reconstruct several years of his activities.

Carriers may retain records for years. In 2022, carriers told the FCC chair they kept geolocation data for as long as five years. The source also says retained logs can be used to build behavioral profiles for advertisers and data brokers, and may sometimes be shared with the government.

Cape, the mobile carrier featured in the source, says it deletes internal call and text records after one day. It keeps some other records longer: SIP messages for 14 days, daily usage totals for up to 60 days, and partner billing records for 30 days. Trail of Bits audited Cape’s deletion feature in May and July 2026; the source says the audit found no evidence that the two claims under review were violated.