Mobile Carriers Store Call Logs for Years, Raising Privacy Risks

109 million people (nearly a third of Americans) suffered a massive data breach in April 2024 that exposed their AT&T communication logs.

AT&T breach: scale, timing, and contents

In April 2024, AT&T disclosed a breach that exposed communication logs for roughly 109 million people. The exposed records covered phone numbers, counts of calls and texts, call durations, and location data from May–October 2022 and January 2023 — roughly two years before the breach was disclosed. AT&T said the records did not contain call content, customer names, or Social Security numbers.

Inside call logs: SIP messages and CDRs

Two technical record types are central to what carriers store and what was exposed. Session Initiation Protocol (SIP) messages manage the start and stop of calls and texts and are used mainly to troubleshoot dropped calls and failed texts. Call Detail Records (CDRs) summarize each call, text, and data session: who was involved, when it happened, for how long, and often which cell site a phone used. Carriers use CDRs for billing and to settle roaming charges. Even without call content or names, these records can reveal intimate details — closest relationships, home and workplace locations, daily routines, and medical or legal consultations when correlated with other information.

Why telecom metadata is an attractive target

The source lays out three structural reasons call logs are easy to steal. First, carriers retain this data for long periods. While privacy policies commonly promise retention “as long as necessary to fulfill the purposes” stated, carriers told the FCC chair in 2022 that geolocation data can be kept for as long as five years. Second, the repositories of that data are concentrated and therefore high-value targets: the AT&T breach was one of several incidents tied to credential theft on Snowflake, a cloud data platform used by multiple large companies. Third, retained logs have commercial and operational buyers: they are used to build behavioral profiles sold to ad networks and data brokers and, in some cases, are handed to government actors. The reporting also notes that a campaign known as Salt Typhoon, described as China-linked, reportedly compromised every major U.S. carrier, illustrating the geopolitical dimension of the risk.

Cape’s deletion model and the Trail of Bits attestation

Cape, a carrier that markets itself on privacy, advertises a different approach: minimal collection and short retention windows. Cape says it deletes call and text metadata after 24 hours, rotates network identifiers to hinder tracking, and runs its own mobile core so it can control log deletion. Cape describes specific retention windows: SIP messages kept for 14 days to debug network issues, internal CDRs deleted after one day, daily totals (counts of calls, SMS, MMS, and data per subscriber) retained up to 60 days for billing and spam prevention, and partner-sent CDRs held 30 days to allow billing disputes.

To back those claims, Cape hired Trail of Bits for an audit in May and July 2026. Trail of Bits reported finding no evidence of violations of the two claims it evaluated: that CDR files are being deleted within Cape’s retention policy, and that Cape does not extract or retain data from CDRs about individual consumer customers except for daily totals, which are retained for no more than 60 days.

What this means for journalists, security teams, and end users

• Journalists and executives: The source explicitly names journalists and executives among those who should treat carrier retention policies as part of their threat models. Call metadata can reveal communications with sources or advisors even when content is not recorded.
• Security teams and IT leaders: The breach underscores that better perimeter or cloud security matters, but retaining less data is a complementary control. The reporting notes that records deleted days after an event cannot be stolen years later.
• End users and callers to doctors or lawyers: Call logs can persist for years and, when correlated with other data, can reveal visits to medical professionals or communications with lawyers. For people who value privacy around particular contacts, carrier retention policies materially change risk.

One line from the reporting captures the practical takeaway: “You can’t un-breach a database, but you can shrink it.” Where carriers retain extensive historical logs, the data exists to be stolen; where carriers delete records quickly, that exfiltration risk is reduced. After the AT&T disclosure and the industry’s revealed retention practices, the choice of carrier and its retention policy has become a tangible element of personal and organizational security.

Read the original story: https://www.bleepingcomputer.com/news/security/your-mobile-carrier-stores-your-call-logs-for-years/