Skip to content

Search Ransomware Intelligence

Jump to a group, country, industry or search victims.

Listed on a ransomware leak site

AT&T

att.com

AT&T was listed on the Endzone leak site on Sep 18, 2026. Information as of Oct 19, 2026.

Country: United StatesIndustry: Technology
Updated continuously · figures as of Oct 19, 2026
Claimed by
Endzone
First listed
Sep 18, 2026
Claims recorded
1

Leak-Site Claim.

EndzoneConfirmed claim
Posted on the leak site
Sep 18, 2026
Collected by Brandefense
Sep 18, 2026
Data claimed
Not stated
Leak-site post text, written by the group
Revenue: $125.6 billion Initial access was via a CX contractor doing business with AT&T. Access originally used as vehicle for Equipment Changes/Call Forwarding (thanks a lot TORCH patch) - VPN + HVD (both external and internal MyDesktop) instances were accessed for a prolonged period without any detection or incident response taking place. Certificates exported from certlm in the VDI + OPUS self installer (automatically joins EP to S1) opened up the door to the VPN. Salesforce data was accessed via a project manager ATTUID + a DirecTV contractor who for some reason had the apps available in…

Get alerted the moment your company or a supplier is posted on a leak site.

Alert me
Other confirmed victims claimed by the same group
VictimClaimed byCountryIndustryData claimedPosted
Philander Smith University
philander.edu
EndzoneUSUnited StatesEducation and Research500 GB
WARNING
earlywarning.com
EndzoneUSUnited StatesFinancial ServicesNot stated
eTeam
eteam.com
EndzoneUSUnited StatesConsulting15 KB
Trump Mobile
trumpmediainc.com
EndzoneUSUnited StatesConsultingNot stated
Gomomentum.com
gomomentum.com
EndzoneUnknownFinancial ServicesNot stated
Accela.com
accela.com
EndzoneUSUnited StatesGovernment and Public SectorNot stated
Other confirmed victims in the same industry
VictimClaimed byCountryIndustryData claimedPosted
WalkingTree Technologies
walkingtree.tech
QilinINIndiaTechnologyNot stated
PingCAP / TiDB Cloud
pingcap.com
FulcrumsecUSUnited StatesTechnologyNot stated
Amagi Media Labs
amagi.com
N0nINIndiaTechnologyNot stated
All Business Technologies (Fox Hill bookkeeping and tax practice)
allbusinesstechnologies.com
N0nUSUnited StatesTechnologyNot stated
Southwire
southwire.com
HelixUSUnited StatesTechnologyNot stated
Bay Alarm
bayalarm.com
HelixUSUnited StatesTechnologyNot stated

Get Real-Time Alerts, IOC Feeds And Takedowns.

The Brandefense platform watches every leak site for your company, vendors and executives, and acts on what it finds.

Figures as of Oct 19, 2026. Confirmed leak-site claims collected by Brandefense technologies and validated by Brandefense analysts.

Listed on a leak site means a ransomware group has claimed the company; it is not a confirmed breach. To request a correction or removal, contact Brandefense.