 So they made it an attack that paid off handsomely. Now, one might ask, why is AT&T using third-party services for this sensitive customer information rather than dealing with it themselves? Because obviously AT&T has control over the security of their own systems, but not necessarily of third-party services. And what's really annoying about this regarding these giant firms that are entrusted with so much of our personal data is that we keep seeing these kinds of incidents over and over again