2026 AT&T — EndZone ransomware claim via CX contractor access (unverified)
Data compromised
Actor claim (unverified): initial access via CX contractor; VPN/HVD/MyDesktop; cert export from VDI; Salesforce via ATTUID/DirecTV contractor — no attested customer census in listing summary
Technical writeup
Unverified leak-site / extortion claim — EndZone listing observed September 18, 2026 naming AT&T and describing alleged prolonged contractor/VPN/Salesforce access. Distinct from prior cataloged AT&T Snowflake/historical dumps. Company confirmation not located at indexing. recordsAffected 0; companyConfirmed false.
Root cause
Unverified EndZone ransomware/extortion leak-site listing