Though many companies do move bad PR to private communications, in this case a private message makes sense since AT&T is asking for personal information such as the customer's phone number.

What is now the classic playbook.

Smiley Face, say it has been largely mitigated.

Ask for PMs for specific cases.

Making a widespread issue seem isolated as you implement a fix that affects 10M people.