What AT&T data was exposed in the 2024 breach?

AT&T said records of calls and text interactions for nearly all of its wireless customers were copied from a workspace on a third-party cloud platform. The records covered May through October 2022 and January 2, 2023. AT&T said the stolen data did not include the contents of calls or text messages, Social Security numbers, or dates of birth.

Did the AT&T breach expose the contents of text messages?

No. AT&T said the exposed records showed call and text interactions but did not contain the content of calls or text messages.

Was Verizon involved in the same case?

The Justice Department's July 2025 plea announcement did not name the victim companies, but earlier reporting and court-related coverage connected Wagenius to confidential phone records associated with AT&T and Verizon.

What should AT&T customers do after the breach?

Customers should remain alert for phishing and social-engineering attempts, protect their wireless account with the strongest available account security options, and treat unexpected requests for verification codes or account changes with caution. The stolen AT&T dataset was primarily communications metadata rather than message content.

AT&T · Cybersecurity · U.S. Telecom News

AT&T Data Breach Update 2026: Former U.S. Soldier Sentenced to 70 Months

Q: How long was Cameron Wagenius sentenced to prison?

KrebsOnSecurity reported that Wagenius was sentenced to 70 months in federal prison in September 2026.

Cameron John Wagenius, a former U.S. Army soldier linked in cybersecurity reporting to stolen AT&T and Verizon phone records, has been sentenced to 70 months in federal prison.

Published: 25 Sept 2026Updated: 25 Sept 2026By Justin Wilson

What happened

The sentencing is the latest development in a wider telecom hacking and extortion case. Wagenius pleaded guilty to federal charges tied to stolen credentials, confidential phone records, extortion and identity theft. The case is connected in prior reporting to AT&T and Verizon data, while AT&T’s separate 2024 disclosure involved call and text metadata for nearly all of its wireless customers.

Sentence70 monthsFederal prison sentence reported September 25, 2026

DefendantCameron WageniusFormer U.S. Army soldier known online as “kiberphant0m”

Broader case10+ organizationsVictim organizations cited by DOJ in the conspiracy

Extortion soughtAt least $1MAmount prosecutors said conspirators attempted to obtain

The case

What happened in the telecom hacking case

Wagenius’ sentence brings a major federal cybercrime case closer to its conclusion, but it is important to separate the criminal charges from AT&T’s much broader 2024 breach disclosure.

Federal prosecutors said Wagenius took part in a hacking and extortion conspiracy from April 2023 through December 18, 2024, while he was serving on active duty. According to the Justice Department, he and co-conspirators obtained credentials for protected computer networks, stole data, attempted to extort victim organizations and used stolen information in additional fraud.

DOJ said the group used methods including a tool they called “SSH Brute” and communicated in Telegram chats about stolen credentials and unauthorized access. Stolen material was offered for sale on cybercrime forums, while some information was sold or used in additional activity including SIM swapping.

Credentials were a central part of the scheme

Prosecutors said the conspirators obtained and transferred credentials used to access protected networks.

Extortion followed the data theft

DOJ said the group attempted to pressure victim organizations into paying after information had been stolen.

Telecom records became part of the case

Prior cybersecurity reporting connected Wagenius with confidential phone records associated with AT&T and Verizon.

Timeline

How the case developed

April 2023–December 2024

Hacking and extortion activity

Prosecutors said Wagenius and others targeted protected company networks, transferred credentials, stole data and discussed extortion while he was on active duty.

December 20, 2024

Wagenius is arrested

He was arrested in Texas after being indicted on charges involving the unlawful transfer of confidential phone-record information.

March 2025

Guilty plea in the phone-record case

Court records show Wagenius pleaded guilty to two counts involving the unlawful transfer of confidential phone-record information.

July 15, 2025

Broader hacking and extortion plea

DOJ announced that he pleaded guilty to conspiracy to commit wire fraud, extortion in relation to computer fraud and aggravated identity theft.

September 25, 2026

70-month sentence reported

KrebsOnSecurity reported that Wagenius received a 70-month federal prison sentence in the telecom hacking and extortion case.

AT&T breach context

What AT&T said was exposed in its 2024 data breach

In a July 2024 filing with the Securities and Exchange Commission, AT&T disclosed that a threat actor copied files from an AT&T workspace on a third-party cloud platform.

AT&T said the files contained records of customer call and text interactions from roughly May 1 through October 31, 2022, as well as January 2, 2023. The dataset covered nearly all AT&T wireless customers and customers of mobile virtual network operators using AT&T’s network during those periods.

AT&T said the copied records included

Phone numbers that AT&T or MVNO wireless numbers interacted with
Counts of calls and text interactions
Aggregate call duration for a day or month
Cell-site identification numbers for a subset of records

AT&T said the records did not include

The content of phone calls
The content of text messages
Social Security numbers
Dates of birth

Metadata can still be sensitive

Even without the content of a call or message, communications records can reveal who contacted whom, how often they interacted and, in some cases, information connected with cell sites. AT&T noted that phone numbers can often be associated with names using publicly available information.

Source check

What is confirmed — and what comes from reporting

There are several layers to this story: federal court records, government announcements, AT&T’s own breach disclosure and cybersecurity reporting. Keeping them separate avoids overstating what any single source proves.

Confirmed in official records

DOJ and AT&T disclosures

Wagenius pleaded guilty to wire-fraud conspiracy, computer-related extortion and aggravated identity theft.
He previously pleaded guilty to two counts involving unlawful transfer of confidential phone records.
DOJ said the broader conspiracy targeted at least 10 organizations and sought at least $1 million through extortion.
AT&T separately disclosed that nearly all of its wireless customers were included in the 2024 call-and-text metadata incident.

Reported by cybersecurity media

AT&T and Verizon connections

KrebsOnSecurity tied Wagenius to stolen AT&T and Verizon telecom records and the online identity “kiberphant0m.”
Krebs reported that Verizon Push-to-Talk records were offered online in 2024.
Krebs reported on September 25, 2026 that Wagenius received a 70-month prison sentence.
The public July 2025 DOJ plea release did not name the individual victim companies.

That distinction matters. The public DOJ plea announcement does not say Wagenius personally exfiltrated every record in AT&T’s disclosed dataset. It is more accurate to say his criminal case was tied to confidential telecom records and a broader hacking and extortion conspiracy, with AT&T and Verizon identified in prior reporting.

For customers

What AT&T customers should take from the case

The sentencing does not represent a new AT&T breach. It is a legal development connected with already-disclosed telecom data theft. Customers who received earlier notices should still take the underlying exposure seriously, particularly because communications metadata can be useful in targeted phishing and social-engineering attempts.

This is different from someone compromising the Wi-Fi inside your home. If that is your concern, our guide explains how to check whether your internet, Wi-Fi or router has been hacked.

Be cautious with account-change requests

Unexpected calls or messages asking for one-time codes, account PINs or identity details deserve extra scrutiny, even if the sender appears to know information about you.

Use the strongest account security available

Review the security options on your wireless account, keep account PINs private and avoid reusing passwords across important services. For home Wi-Fi, our WPA3 guide explains the router settings worth checking.

Watch for SIM-swap warning signs

A sudden loss of cellular service, unexpected account-change notices or unfamiliar device activity can be signs that an account needs immediate attention.

Changing a password cannot undo exposure of historical call records, but stronger account security can reduce the risk that stolen or publicly available information is used in follow-on fraud.

Why it matters

The case goes beyond a conventional password breach

Phone records, account information and internal credentials can be valuable because they help criminals map relationships, impersonate customers, target employees or attempt SIM swaps.

The case also illustrates the risk created when credentials to cloud or enterprise systems are compromised. DOJ said the conspirators traded credentials and discussed unauthorized access in private chats, while AT&T’s own disclosure said its records were copied from a workspace hosted by a third-party cloud platform.

For broadband and wireless providers, the lesson is not simply to protect the customer-facing login page. Sensitive subscriber information can sit across cloud platforms, internal databases, vendor systems and operational tools, making identity controls and access management central to telecom security.

The bottom line

The 70-month sentence is a significant legal development in a telecom cybercrime case tied in prior reporting to stolen AT&T and Verizon records. AT&T’s 2024 disclosure involved call and text metadata rather than message content, while Wagenius’ criminal case covered a broader pattern of stolen credentials, confidential phone records, extortion and related fraud.

Common questions

AT&T data breach and sentencing FAQs

Who was sentenced in the AT&T and Verizon hacking case?

Cameron John Wagenius, a former U.S. Army soldier who used the online name “kiberphant0m,” was reported by KrebsOnSecurity to have received a 70-month federal prison sentence in September 2026.

How long was Cameron Wagenius sentenced to prison?

KrebsOnSecurity reported a 70-month federal prison sentence on September 25, 2026.

What data was exposed in the AT&T breach?

AT&T said the exposed records included call and text interaction metadata for nearly all of its wireless customers during specified periods in 2022 and one day in January 2023. The records included numbers contacted, interaction counts and aggregate call duration, with cell-site identifiers included in a subset.

Were the contents of AT&T text messages stolen?

AT&T said the copied dataset did not contain the content of calls or text messages. It also said Social Security numbers and dates of birth were not included.

Was Verizon part of the same case?

The July 2025 DOJ announcement did not identify victim companies by name. Earlier reporting from KrebsOnSecurity connected Wagenius with confidential records associated with AT&T and Verizon.

Was the entire AT&T data breach caused by Wagenius?

The public DOJ plea announcement does not say that Wagenius personally stole every record in AT&T’s disclosed dataset. His case involved confidential phone records and a broader hacking and extortion conspiracy, while reporting connected him to stolen AT&T and Verizon data.

Should AT&T customers change their password?

Strong, unique passwords and account security are still good practice, but changing a password does not remove historical call metadata that was already copied. Customers should also be alert for phishing, social engineering and unauthorized account changes.

References