AT&T Inc., the largest US phone company, sued 25 data brokers, claiming they got unauthorized access to customer account information.
A complaint filed yesterday in San Antonio federal court claims the brokers set up online billing accounts using customers' identities. That gave the brokers access to as many as 2,500 calling histories and other confidential data, the complaint said. The information can be sold for use in lawsuits and domestic disputes, AT&T said.
``Defendants' actions invade the privacy, and potentially the economic and physical well-being, of AT&T's customers," the company said in its 15-page complaint.
Fraudulent trafficking in phone records has drawn the attention of companies and the US Congress. Cingular Wireless LLC and Verizon Wireless, the largest US mobile-phone service companies, have gotten court orders to stop brokers from engaging in the practice. House and Senate bills to protect records and demand information on brokers' methods are awaiting floor votes.
Customers can set up online electronic billing accounts by providing the last four digits of their Social Security numbers or three-digit codes that otherwise appear only on paper phone bills, the complaint said. The defendants used those numbers to set up the accounts, the company said, adding that it doesn't know where the brokers got the numbers or who the brokers are.
``AT&T does not know how the defendants obtained the personal information," the complaint said. The defendants can't be identified by anything more than an e-mail address and the Internet protocol addresses of the computers they used. Only Internet service providers can identify subscribers by using that information, the complaint says.
AT&T customers at the time could also set up online accounts over the phone, and outsiders could use ``spoofing" technology to fool the company system into thinking a call was coming from a customer's number, the complaint said. The call-in system is no longer used, AT&T said.
The complaint said AT&T began notifying affected customers of the suspected fraud in July and blocked the online accounts. The accounts don't provide credit-card, bank account, or Social Security numbers, the company said.
The company accused the defendants of computer fraud, harmful access by computer, and simple fraud.