I think encrypted DOBs and SSNs are the smoking gun. There may be no way to prove that '1996-07-18' DOB came from AT&T but it's quite hard to deny that the encrypted value '*0g91F1wJvGV03zUGm6mBWSg==' was produced by their systems (or not).
Even if we had AT&T’s keys, I think it might be non-trivial to verify that they correspond to this data, depending on how AT&T encrypts.
What I was trying to say is that if AT&T systems (or a backup) contain that exact encrypted value (no need for a decryption key), it's a near-certain proof that the data came from their system.
> then at the end you say “(or not)”.
Well, only AT&T DBAs/SREs should be able to confirm what I wrote above and I don't want to accuse anyone without proof. Same reason why Troy Hunt wrote "allegedly".
Of course that doesn't say anything about the other PII but at this point, I figure my PII has already been leaked multiple times.