Personal information, including Social Security numbers and call records, was accessed for an unknown number of AT&T Mobility customers by people outside of the company, AT&T has confirmed.
The breach took place between April 9-21, but was only disclosed this week in a filing with California regulators. While AT&T wouldn't say how many customers were affected, state law requires such disclosures if an incident affects at least 500 customers in California.
"Employees of one of our service providers violated our strict privacy and security guidelines by accessing your account without authorization," the company said in a letter to affected customers. "AT&T believes the employees accessed your account as part of an effort to request codes from AT&T than are used to unlock AT&T mobile phones in the secondary mobile phone market."
Many cellphones are provided by carriers with a software lock that prevents them from being used on the networks of competitors, but customers can typically request an "unlock code" that removes the restriction.
Once unlocked, they are more valuable on the second-hand market because they can be used on both AT&T and T-Mobile in the U.S. and the majority of cellphone networks around the world.
The company declined to comment on whether the phones had found their way to the second-hand market through legitimate channels or as a result of theft. Thousands of smartphones are stolen across the U.S. every year and are often sent overseas because of efforts by U.S. carriers to block their use within the country.
While inside customer accounts, those who accessed the data would have also had access to details of the time, date, duration and destination of phone calls made by customers, AT&T said.
"We recently learned that three employees of one of our vendors accessed some AT&T customer accounts without proper authorization," the company said in a statement.
"This is completely counter to the way we require our vendors to conduct business. We know our customers count on us and those who support our business to act with integrity and trust, and we take that very seriously. We have taken steps to help prevent this from happening again, we are notifying affected customers, and we have reported this matter to law enforcement," it said.
AT&T declined to provide any additional information on the incident.
Martyn Williams covers mobile telecoms, Silicon Valley and general technology breaking news for The IDG News Service. Follow Martyn on Twitter at @martyn_williams. Martyn's e-mail address is martyn_williams@idg.com