FCC Settles with AT&T for Vendor Cloud Breach

The Federal Communications Commission announced a $13 million settlement with AT&T to resolve an Enforcement Bureau investigation into the company’s supply chain integrity and whether it failed to protect the information of AT&T customers in connection with a data breach of a vendor’s cloud environment. AT&T used the vendor to generate and host personalized video content, including billing and marketing videos, for AT&T customers. Under AT&T’s contracts, the vendor should have destroyed or returned AT&T customer information when no longer necessary to fulfill contractual obligations, which ended years before the breach occurred. AT&T failed to ensure the vendor: (1) adequately protected the customer information, and (2) returned or destroyed it as required by contract.