PULSE
FEED
Ransomware · Claim18 September 2026 · 07:06 UTC
CLAIMclaimed byENDZONE

AT&T

att.com

CountryUSUnited States
SectorTechnology
Key factsRECORD
Ransom amountNot disclosed
Data size exfiltratedNot disclosed
Screenshot on leak siteNo
Press mentioned by groupNo
Description

Revenue: $125.6 billion Initial access was via a CX contractor doing business with AT&T. Access originally used as vehicle for Equipment Changes/Call Forwarding (thanks a lot TORCH patch) - VPN + HVD (both external and internal MyDesktop) instances were accessed for a prolonged period without any detection or incident response taking place. Certificates exported from certlm in the VDI + OPUS self installer (automatically joins EP to S1) opened up the door to the VPN. Salesforce data was accessed via a project manager ATTUID + a DirecTV contractor who for some reason had the apps available in Salesforce. AT&T CSO, if you are reading this, you are to contact us ASAP!

Other victims from group · ±48h1
AgoVictimCountrySectorSizeCap.
45d
Accela.comAccela.com
USGovernment & Defense—○United States