What happened
Snowflake customer accounts compromised via credential-stuffing with previously-stolen credentials. The attackers (UNC5537 / Scattered Spider / ShinyHunters) did NOT exploit a vulnerability in Snowflake's platform: they used stolen credentials against Snowflake customer accounts that lacked MFA. AT&T was one victim: personally identifiable information including SSNs, dates of birth, account passcodes, names, emails, mailing addresses, and account numbers for ~73 million people (7.6M current customers + 65.4M former). Multiple other Snowflake-customer breaches followed.
Reported impact: AT&T $370K ransom paid; broader customer-cohort impact ongoing
Source: Security.org / CNBC, 19 Apr 2024.
What to do if you were affected
- Change the password for this account, and for any other account that used the same one.
- Turn on two-step sign-in for your email.
- Watch statements and messages that ask you to confirm details; they often follow a breach.
Common questions
When was the Snowflake customer credential-stuffing: AT&T 73M records breach disclosed?
In April 2024. Public reporting was carried by Security.org / CNBC.
How many people were affected?
73,000,000 records, by the figure in the disclosure. Whether your own details were among them depends on your relationship with Snowflake customer credential-stuffing: AT&T 73M records at the time.
How do I check whether my address was in it?
Enter the address in the check above. We check that one address against monitored breach databases and show what was exposed and what to do first. No account needed.
Is the data still a risk years later?
Often, yes. Lists from old breaches keep being copied and reused, so a password from one can still be tried today. Changing it, and not reusing it, closes that door.
Other breaches in this sector
Dodo PizzaSep 2026 · 68,000,000 recordsTicketmasterMay 2024 · 560,000,000 recordsLondon DrugsApr 2024 · 3,000,000 recordsIndigo BooksFeb 2023 · 60,000 records
Is your address in a public breach? Check my address →