Identity for Telecommunications

The job identity does in telecom

Telecom operators run consumer identity at enormous scale while sitting under the rest of the economy's authentication. A phone number is a login factor, a recovery channel and an identity attribute for banks, exchanges and SaaS products. So an operator's identity failures have two costs: its own subscribers' data, and every downstream account protected by an SMS code to a number the operator can be tricked into moving.

Telecom accounts for 4 of the 123 incidents in the Identity Breach Database (3.3%), 2 disclosed in 2021-2022 and 2 in 2023-2024. The count is small and the scale is not: the three that report a number of people or customers add up to 155,379,455, about 155 million, per the records (notifications, not deduplicated people). (Twilio's two incidents are classified as B2B SaaS, matching other cloud communications vendors, per the Identity Breach Report 2026.)

The identity threat picture, from the incident record

Subscriber data behind a single-factor login. In April 2024 attackers opened AT&T's workspace on Snowflake and took call and text records for nearly all its wireless customers from mid-2022, reported as about 110 million people. The records held phone numbers, interaction counts and some cell site IDs, not content. It was part of the Snowflake campaign: a password harvested by infostealer malware and no MFA on the account. The US Department of Justice twice authorized AT&T to delay public disclosure.

APIs without authorization. In September 2022 an attacker sent requests to an internet-facing Optus API that returned customer data without valid authorization, affecting about 9.5 million people per the OAIC. ACMA alleges a 2018 coding error left the access control open, and that Optus fixed it on its main domain in 2021 but not on the dormant API domain. ACMA filed Federal Court proceedings in May 2024, and in August 2025 the OAIC announced civil penalty proceedings alleging one Privacy Act contravention per affected individual.

Identity infrastructure flaws and session theft. Comcast Xfinity was hit through Citrix Bleed (CVE-2023-4966) between 16 and 19 October 2023, after the patch shipped on 10 October but before Comcast finished mitigating. Citrix Bleed leaked session tokens, so MFA was bypassed. 35,879,455 customers were notified and passwords were reset. The technique is token replay on an unbound endpoint.

Stolen staff credentials. In March 2022 LAPSUS$ used stolen credentials to reach T-Mobile internal systems housing operational tools, and leaked chats show source code was taken. T-Mobile said the systems held no customer or government data.

What is missing. None of the 4 telecom records is a SIM swap. The database records breaches of the operator, and SIM swaps victimize the subscriber's accounts elsewhere. MFA was absent in 1 record (AT&T), bypassed in 1 (Comcast), not applicable in 1 (Optus) and unknown in 1. 2 of the 4 carry a recorded regulatory or legal action.

The regulatory floor

• Privacy and breach law: GDPR in Europe, Australia's Privacy Act 1988, whose maximum civil penalty for a company is the greater of A$50 million, three times the benefit obtained or, where the benefit cannot be determined, 30% of adjusted turnover, and US CPNI rules for customer proprietary network information. In November 2023 the FCC also adopted rules requiring wireless providers to use secure methods of authenticating customers before SIM changes and port-outs.
• NIS2 covers digital infrastructure providers, with MFA or continuous authentication and privileged access governance as baseline measures and an early incident warning within 24 hours. Member States review their entity lists by 17 April 2027. See identity controls for NIS2.
• eIDAS 2.0: every Member State must offer a European Digital Identity Wallet by 24 December 2026, and telecoms required to use strong user authentication must accept it by 24 December 2027. That gives operators a new, stronger proofing option for SIM changes and contracts.
• US listed operators also disclose material incidents on Form 8-K under SEC rules, as AT&T did.

The identity controls that matter most

1. Object-level authorization on every API that returns personal data. Authentication alone is not enough; each request must be checked against the caller's right to that record. Retire dormant endpoints and test access controls in the release pipeline. See authentication vs authorization.
2. Patch identity edges, then kill every session. For a token-leaking flaw like Citrix Bleed, patching without revoking sessions leaves stolen tokens valid. See session hijacking and, longer term, ZTNA in place of exposed VPN appliances.
3. MFA and network allow lists on data platforms. Metadata on more than 100 million people sat behind a password at AT&T. Enforce MFA and conditional access on every analytics and SaaS tenant.
4. Phishing-resistant MFA and managed devices for staff and contractors. Credentials bought or phished from employees stay useful until logins require phishing-resistant MFA.
5. Step-up and verification on SIM changes and number ports. Verify at stores and call centers with methods a caller cannot satisfy from leaked personal data, and add delays and alerts on high-risk changes. See help desk social engineering and SIM swap.
6. Offer subscribers more than SMS. Passkeys for operator accounts reduce stuffing and takeover, and reduce the operator's own dependence on the channel SIM swaps defeat.

Vendor categories and named vendors

• Consumer CIAM with fraud: Transmit Security for high-scale authentication and risk. See best CIAM for high scale.
• Phone and SIM risk signals: Prove for phone-number-based identity and possession checks.
• Workforce and partner federation: Okta or Ping Identity, with Yubico keys for phishing-resistant login.
• Replacing exposed remote access: zero trust access such as Zscaler or Cloudflare; see best zero trust tools.
• Identity threat detection: CrowdStrike Falcon Identity Protection and peers in ITDR for spotting replayed sessions and anomalous admin activity.

Background on requirements is in identity for telecom.

Common pitfalls

• Treating API authentication as authorization, the Optus failure.
• Patching an edge appliance without terminating existing sessions.
• Relying on SMS OTP for the operator's own accounts.
• Weak verification at stores and call centers, where SIM changes are socially engineered.

Where it is heading

EU wallets give operators a stronger proofing option for SIM changes from 2027, regulators are moving SIM-swap defense from good practice to rule, and the Optus proceedings show privacy regulators counting penalties per affected person.

Frequently asked questions

How have telecom operators been breached through identity?

In the database's 4 telecom incidents: a data platform login without MFA (AT&T), an API without authorization (Optus), session tokens leaked by Citrix Bleed (Comcast) and stolen staff credentials (T-Mobile).

Why does the database show no SIM-swap incidents for telecom?

It records breaches of the operator. SIM swaps usually harm the subscriber's bank, exchange or email accounts, which is why operators' verification at SIM change matters to everyone else.

Does patching Citrix Bleed fix the problem?

Not alone. The flaw leaked session tokens, so existing sessions had to be terminated as well as the appliance patched.