Also, it wasn't just AT&T that is refusing service to him, his webhost HostedHere.net did the same thing.
And if this has been happening over and over again for 9 years why didn't he just want to go to another service provider?
More importantly you have to question how much of the security problem Mitnick poses in this? If he is part of the cause I think AT&T & HostedHere probably are reasonable to want to get rid of him
(btw I suspect the 8 numeral password is a pin number: similar to the ones handed out by banks for online logins. Could still be his fault it is out in the wild though)
It's been 9 years (we dont even know how much of it is AT&T vs. Mitnicks fault and what contact he has had with them): it's looking like an infinite battle to "secure" his identity. If there are crucial security flaws in their process then yes I am in agreement - but I doubt that is the case (because Mitnick would then be the least of their problems :)). Wash hands, move on.
It's the same thing Sprint did a couple years ago when they dumped people that called customer service too much.
Cue mass attempts to break into AT&T from every angle (which is sure to end badly) :)
It's not super secure, but it really should be secure enough if a website cares about security -- they should be limiting login attempts, and shouldn't be storing them in plain text.
Mitnick said that per AT&T policy, his password could only be digits and no more than eight characters long.