AT&T Call Centers Sold Mobile Customer Information To Criminals 92
itwbennett writes Employees at three call centers in Mexico, Colombia and the Philippines sold hundreds of thousands of AT&T customer records, including names and Social Security numbers, to criminals who attempted to use the customer information to unlock stolen mobile phones, the U.S. Federal Communications Commission said. AT&T has agreed to pay a $25 million civil penalty, which is the largest related to a data breach and customer privacy in the FCC's history.
Hand slap, LOL. (Score:5, Insightful)
So that's what? 1/500th of a month's revenue for AT&T? Geez, they must be stinging for that hand slap!
Re:Hand slap, LOL. (Score:5, Insightful)
When a company says that they'll protect your data, can they really speak for every one of the employees or contractors they hire? That's ultimately the fatal flaw with giving a company your personal data, even if their carefully crafted, lawyer approved privacy statement has the best of intentions.
Re: (Score:2)
When a company says that they'll protect your data, can they really speak for every one of the employees or contractors they hire?
Especially when they offshore so much of their workforce in order to pay shit wages. Some guy sitting in a boiler room in Colombia has very little connection to his parent company and is outside the jurisdiction of the US. I'd say that gives him more incentive to steal and sell corporate data, or at least less incentive not to, than a happy US-based employee.
Re: (Score:2)
"When a company says that they'll protect your data, can they really speak for every one of the employees or contractors they hire?"
Who else can they be speaking for? A company is not a person in the sense that it cannot do anything. Only its employees and contractors can do anything.
Re: (Score:3)
Re: (Score:2)
OMG. I can't imagine ANY corporation with more than a couple of 'stores', particularly across more than one state, having a privacy statement vetted by lawyers that 'has the best of intentions' for their customers. They all are worded to be "we'll try to make sure we know everyone accessing your private data, but if we don't, there's no penalty".
Re: (Score:2)
I was hoping people would catch the slightly sarcastic tone there. Too subtle?
Re: (Score:2)
umm..
well, they can speak for their subcons. after all, that's what they did when they implied that your data wouldn't be sold to criminals outside the company.
and that's why they got fined 25 mil, because they did something wrong. should have been a higher sum, but still, they fucked up by doing less of a background check to their employees than they do to their customers!
it's not like anyone forced the company to outsource shit to pacific asia.
Re: (Score:3)
Yet these people were not actual AT&T employees but contractors, so no telling what type of checks are used. This isn't the first time AT&T has had this problem...in 2010 the FBI a
Re: (Score:2)
This is the first time AT&T has been found guilty of this charge. Sure it is a slap on the wrist but if they do it again I bet the slap will be much harder.
Re:Hand slap, LOL. (Score:5, Interesting)
Or, maybe they will do it again but, next time, they'll sell information to criminals using the information for identity theft instead of unlocking stolen phones. Is that different enough to warrant yet another slap on the wrist?
Wake the fuck up and realize that AT&T, Comcast, and the like will simply adjust their behavior just enough that people like you well say "oh, well that's something different" so they never suffer anything amounting to more than a warning shot across their bow, as they've been doing for decades, until people like you stop accepting it.
Re: (Score:2)
RTFA (Score:4, Insightful)
they'll sell information to criminals using the information for identity theft instead of unlocking stolen phones.
AT&T didn't sell the information this time. Some AT&T employees stole the information and sold it. AT&T is being fined for having lax procedures that allowed the original theft.
What is your solution?
By the way, the use of profanity does not strengthen your argument.
Re:RTFA (Score:5, Insightful)
AT&T didn't sell the information this time. Some AT&T employees stole the information and sold it. AT&T is being fined for having lax procedures that allowed the original theft.
Yes, they allowed the data to be stolen. They didn't put in place anything even resembling reasonable access restrictions, no safeguards to keep the low-level employees who don't need customers' social security numbers and banking information (yes, they have access to that, too; it's amazing that wasn't also stolen, or maybe it was) from accessing that information. In fact, not only did they not prevent said access, they fed them the data, they put it right there in the portal they provide their support reps, where it's on display for the duration of the support call. It's not a matter of incompetent security measures, it's a matter of gross negligence in how they handle customer data and they should bear much more liability for that negligence than one might be expected to bear for incompetence.
What is your solution?
Maybe a fine that equates to a liability of more than $100 per person whose data they allowed to be stolen and sold? After all, this trial was about liability, right? And damages? Maybe convincing them to fix the problem? I don't think 0.02% of their annual revenue will do that.
By the way, the use of profanity does not strengthen your argument.
Well, I guess it's a good thing my intent was to express frustration, then.
Re: (Score:1)
banking information (yes, they have access to that, too; it's amazing that wasn't also stolen, or maybe it was)
Where is this information coming from. It is not in the article.
Maybe convincing them to fix the problem? I don't think 0.02% of their annual revenue will do that.
You know that how? Maybe the threat of much higher fines if it happens again may have the desired effect.
It is funny how people get a break on a first offense but companies don't.
Re: (Score:2)
Where is this information coming from. It is not in the article.
Knowing, personally, an AT&T support rep who has, on numerous occasions, told me how appalled she is that this information is accessible to anyone from tier 1 on up.
It is funny how people get a break on a first offense but companies don't.
It's funny how this was a civil trial, where people don't get a break for their first offense, but you think it's cool that companies do.
Re: (Score:1)
It's funny how this was a civil trial
There was no trial. It was a consent decree [fcc.gov] and not a court case. You might want to look up what civil penalty [wikipedia.org] actually means.
A civil penalty or civil fine is a financial penalty imposed by a government agency as restitution for wrongdoing.
Civil penalty has nothing to do with what type of court, civil or criminal.
Re: (Score:2)
Re: (Score:1)
show me an instance where a civilian got off with a slap on the wrist violating FCC regulations regarding securing CPNI
Show me where a civilian can violate those regulations. Those regulations govern companies not individuals.
By the way, this has nothing to do with CPNI [wikipedia.org].
Customer proprietary network information (CPNI) is the data collected by telecommunications companies about a consumer's telephone calls.
It has to do with private account information like SSNs. This appears to be another use of a technical term used that you have no idea what it means and for some reason won't even look up.
Trial or no trial, this is a civil matter
Wrong again. This is a regulatory matter as the the company failed to follow the Communications Act.
The failure to reasonably secure customers’ proprietary information violates a carrier’s statutory duty under the Communications Act to protect that information, and also constitutes an unjust and unreasonable practice in violation of the Act.
Re: (Score:3)
By the way, this has nothing to do with CPNI
Paragraph 1 of the consent decree begs to differ.
The Enforcement Bureau (Bureau) of the Federal Communications Commission (Commission) has entered into a Consent Decree to resolve its investigation into whether AT&T Services, Inc. (AT&T or Company) failed to properly protect the confidentiality of almost 280,000 customers’ proprietary information, including sensitive personal information such as customers’ names and at least the last four digits of their Social Security numbers, as well as account-related data known as customer proprietary network information (CPNI), in connection with data breaches at AT&T call centers in Mexico, Columbia, and the Philippines.
You seem to be arguing for argument's sake and are conflicting you own arguments in the process. Buh-bye.
Re: (Score:2)
On that note, good day, sir.
Re: (Score:2)
How about you usethe link [wikipedia.org] I referenced;
It includes the time, date, duration and destination number of each call, the type of network a consumer subscribes to, and any other information that appears on the consumer's telephone bill.
Sensitive information like SSN does not appear on a customer's bill.
Re: (Score:2)
Re: (Score:2)
they'll sell information to criminals using the information for identity theft instead of unlocking stolen phones.
AT&T didn't sell the information this time. Some AT&T employees stole the information and sold it. AT&T is being fined for having lax procedures that allowed the original theft.
What is your solution?
Disallow the companies from keeping this information.
This is how it works in Australia. My ISP is not permitted to keep or even ask for certain bits of information. Your SSN is roughly equivalent to my TFN (Tax File Number) and they cant ask for that, they aren't even allowed to keep my drivers license number on file. They only really have my card number and there is a metric shitload (oops, profanity, we'll you'll just have to get over it) of laws regarding how that information can be kept and where (as
Re: (Score:2)
So how to companies in Australia verify that a customer is not impersonating someone else?
Re: (Score:2)
Re: (Score:2)
I dont know, but they only need to keep on the computer the fact that they have verified it, not the actual verification process.
If a dispute comes up as to who opened the account the company needs to show the data they used to verify against. If they don't have the data they can not prove they verified the identity correctly.
(probably how they verify the data)
The banks ask those questions when the account is opened. In my bank they ask for a security password that I supplied.
Re: (Score:2)
You understand it was contract employees that stole the data, not AT&T Corporate...
Re: (Score:2)
Re: Hand slap, LOL. (Score:2)
Who was it who decided to outsource to poor people who could sell that information for more than they earn in a month.
Re: (Score:2)
... the per capita income in phillipines in 2013 was 3000... yeah... more than they could earn in a month.
Re: (Score:2)
When I first read the headline, I thought that the "criminals" were the NSA. I was wondering what all the fuss was about. It just sounded like business as usual to me . . .
Double the Outrage (Score:5, Interesting)
1. Only $25M for that egregious violation??
2. And that is the *LARGEST* penalty ever????
Token penalties like that are equivalent to declaring a free-for-all-big-corps.
Re: (Score:3)
1. Only $25M for that egregious violation??
AT&T didn't sell the info (the title of the article is false.) It was some people that were employed by their call centers that were engaged in the crime. You don't punish a company for hiring somebody who turns out to be a criminal. All they can be punished for is if the policies that allowed their employees to get that information were negligent.
Re: (Score:3)
Re: (Score:2)
That's what I want to know. Why on earth does do call centers even have access to the full SSN? I could understand the last four digits, as that's oftened used to verify the identity of the caller, but there's just no reason I can see that they would need the full number.
Re: (Score:2)
Re: (Score:1)
I answer calls in a center under contract to AT&T. I doubt this will have any effect on which countries AT&T has call centers, but I suspect that the other employees in the centers where the breaches occurred are ready to lynch the criminals who have cost them their jobs. Luckily, my center was not involved in the thefts. In the wake of these incidents, we have been prohibited from having any kind of recording device at our stations. This includes paper, cell phones, thumb drives, and e-mail.
Re: (Score:1)
AT&T didn't sell the info (the title of the article is false.) It was some people that were employed by their call centers that were engaged in the crime. You don't punish a company for hiring somebody who turns out to be a criminal.
As usual, corporations are people right up until it's inconvenient, then they're an organization and can't be treated the same way as people are.
Re: (Score:2)
Re: (Score:2)
As usual, corporations are people right up until it's inconvenient, then they're an organization and can't be treated the same way as people are.
This has nothing to do with corporations. if you, as a private citizen, hire somebody to do a job, and they then commit a crime using your property, you will not be held responsible for that crime unless it turns out that you were complicit or negligent. AT&T should be held to exactly the same standard.
Re: (Score:2)
Re: (Score:2)
1. Only $25M for that egregious violation??
AT&T didn't sell the info (the title of the article is false.) It was some people that were employed by their call centers that were engaged in the crime. You don't punish a company for hiring somebody who turns out to be a criminal.
Yeah you do.
I, as the end consumer, have no control over who AT&T outsources too.
By hiring this outsourcer and giving them access my account, AT&T is giving their stamp of approval for this company to act on their behalf and be, for all intents and purposes, AT&T as far as the end customer is concerned. They are backing up the reputation of this company and quality of their work with their own brand identity.
It's like if a buy a car and the automaker has issues from a part failing. It's ultimate
Re: (Score:2)
By hiring this outsourcer and giving them access my account, AT&T is giving their stamp of approval for this company to act on their behalf and be, for all intents and purposes, AT&T as far as the end customer is concerned. They are backing up the reputation of this company and quality of their work with their own brand identity.
It is a terrible idea to make an employer responsible for everything an employee does. It is the responsibility of the employer to have a level of diligence to protect their customers, through policies and actions, but that doesn't mean that they can predict and control everything that a human being will do.
The fact that a $25 million fine was imposed says that the government believed that the appropriate level of diligence was not taken, but I see nothing to suggest that the negligence was great enough to
Re: (Score:2)
No, in most of the world, including the Mafia that is how life is. That is what company directors are paid for. They have the responsibility to see that these things cant and don't happen. In this case, they took no steps whatever to protect their customers private data which they had no legitimate reason to keep.
A more reasonable approach to the crime would have been to determine that (a) the data protection law was
Re: (Score:3)
1. Only $25M for that egregious violation??
2. And that is the *LARGEST* penalty ever????
Token penalties like that are equivalent to declaring a free-for-all-big-corps.
Yeah it's basically .018 cents per dollar revenue and .4 cents per dollar of net income. AT&T must be smarting!
Re: (Score:2)
1. Only $25M for that egregious violation??
2. And that is the *LARGEST* penalty ever????
Token penalties like that are equivalent to declaring a free-for-all-big-corps.
Yeah it's basically .018 cents per dollar revenue and .4 cents per dollar of net income. AT&T must be smarting!
AT&T to employees: STOP RIPPING OFF OUR CUSTOMERS!!!! That's OUR job!
Re: (Score:2)
So... AT&T Call Centers sold customer info... (Score:5, Funny)
to AT&T? And maybe Verizon/Comcast?
I can't think of anyone more criminal.
No way! (Score:1)
But but but that will never happen! The government and companies are responsible with our data!
Who cares about you? Why are you so special? lol you're paranoid
That's new (Score:2, Funny)
That's a switch...usually they just give that information away for free to criminals.
This isn't an improvement for customers, but at least its better for stockholders.
Time for Proportional Fines (Score:5, Insightful)
Re: (Score:2)
It is time to adopt a system similar to Finland, where fines for infractions such as speeding is proportional to income and ability to pay. For AT&T to pay $25 million for this kind of ridiculous breach in security is outrageous. Exactly what economic incentive does AT&T have to change their ways or improve security? If you answered "None. Zero. zip. Zilch.", you win the prize
You read an article on Slashdot and didn't understand it.
Bill Gates has tenthousand times more money than I have. That doesn't mean he eats tenthousand times more, drinks tenthousand times more, and will speed tenthousand times more often than I do. To influence his individual behaviour, you'd have to give him a bigger fine for one violation.
A big company might have a fleet of 10,000 cars. If their drivers behave exactly as good or as bad as I do, they will get 10,000 times as many speeding tickets th
Re:Time for Proportional Fines (Score:5, Insightful)
The proposal is not that if a person commits a crime and pays X amount for it then if a company commits the same crime they should pay X multiplied by the difference in their income, which is what you're arguing against in your example of speeding tickets.
This is in relation to the kinds of crimes that (generally) companies commit, and is arguing that if a large company commits that crime then it should pay a larger fine than if a smaller company commits the same crime.
It is possible that the scale of the crime has been included in the size of the fee, but if so it's a pretty ridiculous standard to begin with. "Hundreds of thousands of customer records" is pretty vague, but let's assume records for 250,000 people. That means a fine of $100 a person. That's not nothing, but it doesn't really cover the potential damage they may have caused. And furthermore in this case, although we are presuming the employees did not sell the data as part of a corporate directive, the fact that they were able to do so indicates some pretty serious lack of oversight and security, and some portion of the fee ought to be related to that. And _that_ part of the fee ought to reflect the size of the company involved.
$25 million could easily bankrupt a small company, but AT&T will hardly notice it amidst the yearly revenue of $132 billion and net income of over $6 billion. So the fine works out to about 0.4% of their yearly profit. In 2011 the average American household had $12,800 of discretionary income available [experian.com], about the best equivalent to corporate profit i can think of. In which case if an average American committed the same crime the "expected" fee would be $51.20. That's not even a speeding ticket, that's about a parking ticket level of fine.
Re: (Score:1)
Worst idea ever. Seems like equality under the law is a concept that has gotten lost.
And as the guy above said; AT&T didn't do this. Criminals that lied and got a job with them under false pretenses did this.
I'm IT in a company that accepts credit card payments. I might could make off with the whole list with nobody noticing. Our salespeople have even more direct contact with customers cc info, somewhat similar to AT&Ts probably. They wouldn't even have to steal anything; the cc info is given to the
Re: (Score:2)
Of c
oh (Score:2)
So.... (Score:2)
How's that "best shore" strategy working out for ya?
Data protection laws lacking (Score:2)
Re: (Score:2)
Consent will just become another paragraph of boilerplate in the contract you agree to for service.
Aha (Score:5, Funny)
That explains the increase I just saw in my bill. An extra $15... they are already trying to squeeze their customers to pay for the fine.
Re: (Score:2)
That explains the increase I just saw in my bill. An extra $15... they are already trying to squeeze their customers to pay for the fine.
I bet that came as a line item on the bill, saying something like "government fees". So not only do they pass the cost on to customers, they try to blame them for it as well.
So, (Score:1)
To whom will they pay the fine? The FCC?
They should divide the $25M (or at least a very high % of it) and pay it to the "hundreds" of people that were actually affected.
Galling (Score:3)
"AT&T has “no reason to believe” that the stolen customer records were used for identity theft or financial fraud, the company said in a statement."
"AT&T has “no reason to believe” that the stolen customer records have been used for identity theft or financial fraud yet, the company said in a statement."
[ftfTFA] It is at times like these that I feel like we should be telling companies to take a hike when they require information like SSNs to sign up for an account.
Outsourcing has its pitfalls (Score:1)
I wonder if this was discussed at the meetings when they calculated the savings of outsourcing the work and that outsourcing being offshore. I guess they don't teach that at business schools. Ideally these people would not have access to this data to even sell but again, the risks were considered and they took a chance at a savings instead.
At least Cisco was able to get the federal government (FBI/CIA) to pay the bill, police the situation, and mitigate the risks of their outsourcing problems when they no
Why SSN (Score:2)
Oblig. (Score:2)
But we already knew they were selling data to the government.
*badum tish*
$25 million for two characters (one broKen) (Score:2)
Apple imposes a $50 million fine for leaks, GT Advanced reveals [digitalspy.com]
Perhaps LG is now facing more of the same, for leaking two whole characters: "8K".
What I'm hoping is that LG pushes back, and when it goes to court LG successfully argues they didn't tip any technical parameters about a forthcoming Apple product, because "K" doesn't mean 1000, and "K" doesn't mean 1024, and in fact doesn't mean any number at all, contrary to what the Apple marketing people apparently think.
Who comitted the crime, who pays the fine (Score:2)
So a couple low-level workers go all Snowden/Manning and steal company data and sell it on the open market, and their employer is stuck with a $25M fine... Seems fair.
to criminals? (Score:2)
They sold it to criminals? Is that like to other phone companies or especially ISPs? Or merely to the NSA?
Look At The Countries (Score:2)
All three or notorious for corruption .. in everything! Why should we be surprised that AT&T call centers are vulnerable to corrupt employees?