 AT&T apparently went ahead and paid a ransom of approaching $400,000 to get the data deleted, so they made it an attack that paid off handsomely. Now one might ask, why is AT&T using third-party services for this sensitive customer information rather than dealing with it themselves? Because obviously AT&T has control over the security of their own systems, but not necessarily of third-party services.