Sponsored piece: carriers retain call logs for years, citing 2024 AT&T breach of 109M customers' records
This is a Cape-sponsored article, not a new incident report. It argues that long retention of call metadata by mobile carriers is a risk in itself, and it cites the April 2024 AT&T breach, which exposed communication logs of about 109 million current and former customers. The exposed data covered May to October 2022 and January 2023: phone numbers, call and text counts, call durations and location data. AT&T said it did not include call content, customer names or Social Security numbers. The article also recalls that AT&T was one of several Snowflake customers hit by credential-based thefts, and that Salt Typhoon reportedly compromised every major US carrier. It then promotes Cape's short-retention model.
Detalhes técnicos
- Carriers generate SIP messages (session setup and teardown, used for troubleshooting) and Call Detail Records (CDRs) (who, when, how long, often which cell site, used for billing and roaming settlement).
- Metadata can reveal close relationships, home and work locations and daily routines, and can be correlated with public data to derive identities.
- In 2022 carriers told the FCC chair that they kept geolocation data for up to five years.
- Cape says it keeps SIP messages for 14 days, deletes internal CDRs after 1 day, keeps daily totals for up to 60 days and holds partner-supplied CDRs for 30 days. It also rotates network identifiers.
- Cape says Trail of Bits audited the feature in May and July 2026 and found no evidence that the two retention claims were violated. This is a vendor claim.
Remediação
- Reduce exposure by minimizing retained metadata. The article recommends carriers with short retention windows.
- High-risk users (journalists, executives, security staff) should treat carrier retention policy as part of their threat model.
Linha do tempo
-
Sponsored piece: carriers retain call logs for years, citing 2024 AT&T breach of 109M customers' records
ler a análise desta fonte ocultar
This is a Cape-sponsored article, not a new incident report. It argues that long retention of call metadata by mobile carriers is a risk in itself, and it cites the April 2024 AT&T breach, which exposed communication logs of about 109 million current and former customers. The exposed data covered May to October 2022 and January 2023: phone numbers, call and text counts, call durations and location data. AT&T said it did not include call content, customer names or Social Security numbers. The article also recalls that AT&T was one of several Snowflake customers hit by credential-based thefts, and that Salt Typhoon reportedly compromised every major US carrier. It then promotes Cape's short-retention model.
Technical Details
- Carriers generate SIP messages (session setup and teardown, used for troubleshooting) and Call Detail Records (CDRs) (who, when, how long, often which cell site, used for billing and roaming settlement).
- Metadata can reveal close relationships, home and work locations and daily routines, and can be correlated with public data to derive identities.
- In 2022 carriers told the FCC chair that they kept geolocation data for up to five years.
- Cape says it keeps SIP messages for 14 days, deletes internal CDRs after 1 day, keeps daily totals for up to 60 days and holds partner-supplied CDRs for 30 days. It also rotates network identifiers.
- Cape says Trail of Bits audited the feature in May and July 2026 and found no evidence that the two retention claims were violated. This is a vendor claim.
Remediation
- Reduce exposure by minimizing retained metadata. The article recommends carriers with short retention windows.
- High-risk users (journalists, executives, security staff) should treat carrier retention policy as part of their threat model.