AT&T Paid a Hacker $370k to Delete Stolen Phone Records | Hacker News Reader

AT&T Paid a Hacker $370k to Delete Stolen Phone Records

wired.com

49 pointsthunderbong23 comments

On one hand, there's like a 1% chance the data was actually fully deleted. OTOH, $370,000 is literally nothing to AT&T, so paying "nothing" for a 1% chance of maybe the data getting deleted seems like a decent wager for AT&T to make?

Sonehow, I wonder if this might be more ass-covering than anytbing else. Perhaps to report to the regulator that they've done all they can. Or maybe, if they ever track down the people responsible fot the hack, you can imagine AT&T suing for breach of contract!

A bill in the future:

"Secure Data Fee - $4.51"

> AT&T is one of more than 150 companies that are believed to have had data stolen from poorly secured Snowflake accounts

Is there a list of the other affected companies somewhere?

One news site says there are 165 organizations affected[1], and links to some documents by Mandiant[2][3], but I can only find snippets that lists a few companies.

[1] https://www.securityweek.com/snowflake-attacks-mandiant-link...

[2] https://cloud.google.com/blog/topics/threat-intelligence/unc...

[3] https://services.google.com/fh/files/misc/snowflake-threat-h...

http://archive.today/kmlMw

cloudflare is blocked here... do you have a better archive?

Maybe consider using https://quad9.net for DNS? It's nice having archive.today work. Otherwise you can always copy/paste the link to TFA into https://archive.org

The DNS is not the problem... the site itself gives me a "you are blocked" page directly from CF. I don't get a different result from using different DNS either way.

> cloudflare is blocked here

Not affiliated with cloudflare at all, just curious - where is "here" and why is a major edge cloud provider blocked?

archive.today doesn't use CloudFlare in the first place. I think ranger_danger meant to say that they use Cloudflare's DNS resolver (1.1.1.1) which doesn't work with archive.today. (archive.today wants location information that the client normally sends in its DNS request to be able to route the client to an appropriate server, but CloudFlare's resolver sends its own location with less granularity which breaks that.)

> One more step

> Please complete the security check to access archive.ph

It's not a DNS issue (and I don't use theirs), the site itself uses CF and I get endless captcha loops. Sometimes the site will just say "you are blocked" instead too, or even "Your browser is out of date" when it's not.

https://community.cloudflare.com/t/one-more-step-please-comp...

For your sanity, I had this same issue for awhile on some of my devices but not others and couldn't understand exactly what was causing it.

archive.today (and its sister sites like .ph) don't use CloudFlare, but given the problems they have with it, they might do something like resolve to a CloudFlare-backed sinkhole if they think you're coming from CloudFlare's resolver. Would be funny if true.

The message I'm getting though ("Please complete the security check to access archive.ph") is from CF, and I do not use their DNS or anyone who does.

Read the comment carefully.

>The message I'm getting though ("Please complete the security check to access archive.ph") is from CF

That is what I said.

>and I do not use their DNS or anyone who does.

That is not what I said.

> is from CF

> That is what I said

No, you said:

> archive.today (and its sister sites like .ph) don't use CloudFlare,

Well done on reading that far. Now do me the favor of reading past that.

I think one could argue that your supposed sinkhole is still "using CF". I still don't agree with your response "that's what I said", and I think you don't really know what they're using anyways so this is a pointless argument IMO.

Either way that's no excuse for the attitude. Please try to think about how your words come across to others and whether you would want to be treated the same way, especially when it is something trivial like a disagreement on terminology.

That's fine. I know how to read so I don't have to worry. When I do have reading failures I have the fortitude to accept my mistake.

The site does not use CF. It is not CF ! Its intentional blocking users with an fake captcha by presenting page that looks like CF branding

> "and provide a video demonstrating proof of deletion."

...

It's the same company that keeps getting breached over and over. Do this really surprises you?

they can't really be that gullible can they? taking bets on this appearing on BF by next week.

Reply on news.ycombinator.com