> Even if we had AT&T’s keys, I think it might be non-trivial to verify that they correspond to this data

What I was trying to say is that if AT&T systems (or a backup) contain that exact encrypted value (no need for a decryption key), it's a near-certain proof that the data came from their system.

> then at the end you say “(or not)”.

Well, only AT&T DBAs/SREs should be able to confirm what I wrote above and I don't want to accuse anyone without proof. Same reason why Troy Hunt wrote "allegedly".