During April 2024, AT&T suffered a significant data breach that compromised communication logs belonging to approximately 109 million customers—roughly one-third of the American population. The exposed records included phone numbers, counts of calls and text messages, call duration information, and location data spanning from May through October 2022 and January 2023, meaning the information was roughly two years old when the incident occurred. Both active and former customers were affected by the breach.
AT&T stated that the compromised records did not include the actual content of calls, customer names, or Social Security numbers. However, this distinction provides limited reassurance. Call logs alone contain substantial personal information: they can identify your closest relationships, pinpoint your home and workplace, and reconstruct your daily schedule in granular detail. Historical records of calls to specific professionals—such as an oncologist—along with timing and duration information, remain in carrier databases indefinitely.
Understanding call logs
Every call, text message, and data session generates records within a carrier's infrastructure. Two categories of records are particularly significant:
- SIP messages: Session Initiation Protocol (SIP) manages calls and texts both within a single carrier and across networks. Carriers primarily use these messages for troubleshooting dropped calls and failed message delivery.
- Call Detail Records (CDRs): These summarize each call, text, and data session by documenting participants, timing, duration, and frequently the cell site location where the phone connected. Carriers rely on CDRs for billing purposes and for settling charges with roaming partners.
Call metadata can be cross-referenced with publicly accessible information to identify individuals. In 2011, German activist Malte Spitz obtained roughly 35,000 records from his telecom through legal action and constructed a detailed chronological account of his activities spanning several years, demonstrating the specificity of information that can be derived from such logs.
Why call logs present an attractive target
Three factors combine to make call logs vulnerable:
- Extended retention periods: Most carriers do not publicly disclose retention timelines. Privacy policies typically state data will be kept for "as long as necessary to fulfill the purposes" outlined in the policy. In 2022, carriers disclosed to the FCC chair that geolocation data was retained for up to five years—substantially longer than operational requirements for phone service. Extended retention enables carriers to monetize this information.
- Concentration in major systems: Carrier data is frequently targeted in breaches. AT&T was among multiple Snowflake customers affected by credential-based attacks, alongside Ticketmaster and Neiman Marcus. Salt Typhoon, a China-linked operation, reportedly gained access to every major U.S. carrier, potentially placing call metadata for any American within reach.
- Commercial demand: Retained logs are processed into detailed behavioral profiles sold to advertising networks and data brokers, and in certain instances provided to government entities.
The AT&T breach represents an inevitable consequence of data retention practices. Records existed and therefore became available for theft.
An alternative approach to retention
Cape, an MVNO operator, implements a different model by deleting call and text metadata within days rather than years. Unlike other MVNOs, Cape operates its own mobile core infrastructure and generates its own logs, providing direct control over deletion timing.
Cape's Disappearing Call Logs feature establishes distinct retention windows for each record category:
- SIP messages are retained for 14 days to enable network troubleshooting, then converted to internal CDRs and deleted after one day
- Daily totals—comprising counts of calls, SMS, MMS, and data usage per subscriber—are maintained for up to 60 days for billing and spam prevention purposes
- CDRs received from partner networks as billing documentation are held for 30 days, sufficient for bill dispute resolution
When calls route through Cape's infrastructure, signaling passes to the nearest radio tower and Cape's partner network operator, which forwards it to Cape's mobile core before routing to the recipient's carrier. Since partner networks and tower operators also generate logs, Cape rotates the identifiers that towers observe, reducing their capacity to correlate those logs to individual subscribers.
Verification through audit
Retention claims require independent verification. Cape engaged Trail of Bits to audit the Disappearing Call Logs feature during May and July 2026, with the attestation subsequently published.
The audit found no evidence contradicting two specific claims:
- CDR files are deleted in accordance with the stated retention policy
- Cape does not extract or retain individual consumer customer data from CDRs beyond daily totals, which represent the number of calls, SMS messages, MMS messages, and data consumed by a subscriber in a single day. Daily totals are deleted after no more than 60 days
Minimizing exposure through data reduction
While strengthening carrier security infrastructure remains important, the more dependable safeguard involves retaining less data. Records deleted within days cannot be stolen two years later.
For journalists, corporate executives, security personnel, and individuals who communicate with doctors, lawyers, or confidential sources, a carrier's data retention policy constitutes a material component of the overall threat landscape.