GM, AT&T, DHS face $220M settlement and massive data leaks

GM’s $220 million privacy settlement

General Motors agreed to pay $220 million to resolve claims that it harvested driver data without consent. The settlement forces GM to obtain explicit permission before collecting or sharing location and driving metrics.

The deal follows a class‑action lawsuit alleging that GM’s OnStar service logged trips, speed, and routes and sold the aggregates to third parties. Plaintiffs argued the practice violated state privacy statutes. GM did not admit wrongdoing but accepted the financial penalty and the consent requirement.

The consent clause is narrow. GM must present a clear opt‑in prompt before any telemetry leaves the vehicle. The company also faces ongoing oversight to ensure compliance. Critics note the settlement size is modest compared to the potential value of the data sold.

AT&T’s dark‑web exposure of 7.6 million customers

AT&T confirmed that a file containing personal data for more than 7.6 million current customers and 65 million former customers has been circulating on the dark web. The leak includes names, emails, mailing addresses, phone numbers, Social Security numbers, dates of birth, account numbers, and four‑digit passcodes.

The breach originated from data collected in 2019 or earlier. The passcodes, used for phone‑call verification, are four‑digit PINs that researchers found easy to decode. AT&T reset the affected passcodes and notified customers by email or letter. The carrier also offered free fraud alerts from the three major credit bureaus.

AT&T said external cybersecurity experts are reviewing the incident. The company reported no evidence of unauthorized system access, suggesting the data may have been extracted from an older backup rather than a live breach. The leak was first reported to AT&T by TechCrunch in 2021, but the company only publicly acknowledged it after the dark‑web file resurfaced.

DHS leak reveals 41,000 workers and undercover agents

A massive data dump exposed the identities of roughly 41,000 Department of Homeland Security employees, including undercover ICE agents and members of surveillance groups. The leak also contained details about privileged DHS access levels.

The source material did not specify how the data was extracted, but the breadth of the exposure raises concerns about internal security controls. The inclusion of undercover agents suggests operational risks for ongoing investigations. No official comment from DHS has been released at the time of writing.

The leak underscores a pattern of government agencies mishandling sensitive personnel data. Prior incidents, such as the 2020 OPM breach, showed that even well‑funded entities can suffer catastrophic exposures when data governance lapses.

Industry context: data monetization versus consent

Automakers, telecoms, and federal agencies have all turned personal data into revenue streams. OnStar’s telemetry feeds have historically been sold to advertisers and insurers. AT&T’s customer database supports targeted marketing and fraud‑prevention services. DHS’s internal directories aid inter‑agency coordination.

Regulators are increasingly demanding explicit consent. The GM settlement codifies that demand for automotive telemetry. The European Union’s GDPR already requires clear opt‑in for processing personal data, and several U.S. states are drafting similar statutes. Yet the industry’s reliance on low‑friction data collection persists, creating a tension between profit and privacy.

Technical safeguards are uneven. GM’s new consent prompt is a software change that can be rolled out to millions of vehicles. AT&T’s passcode reset is a reactive measure that does not address the underlying weak PIN design. DHS’s breach suggests inadequate access‑control policies for employee records. The disparate responses highlight a lack of industry‑wide standards for data protection.

What to watch

Watch for the Federal Trade Commission’s next enforcement action on automotive data practices. The agency hinted at a rulemaking that could extend consent requirements to all connected vehicle services. AT&T is expected to file a detailed breach report with the FCC, which may trigger additional oversight of telecom data handling. DHS is likely to launch an internal review of its personnel database security, and any policy changes could affect future disclosures of classified staff information. Tracking these developments will reveal whether regulatory pressure can curb the current pattern of large‑scale data exposures.