AT&T breach exposed metadata of 109 million customers as carriers keep call logs for years

Cape says its retention claims were checked by an outside auditor, which found no evidence of violations.

A 2024 AT&T breach exposed call and text metadata for 109 million current and former customers, covering May to October 2022 and January 2023, which included phone numbers, call and text counts, durations and location data, though not call content, names or Social Security numbers. The article argues such logs are easy to exploit because carriers keep them for years, with some keeping geolocation data up to five years according to a 2022 FCC response, and because they are a concentrated target and are sold to ad networks and data brokers. It positions Cape, a privacy-focused mobile carrier, as an alternative that deletes call and text metadata within days rather than years, with SIP messages kept 14 days and internal CDRs one day. Cape says it had Trail of Bits audit this retention feature in May and July 2026, and the auditor found no evidence of violations of the two stated claims: CDR deletion within policy and no retention of individual customer CDR data beyond daily totals kept up to 60 days.