“Taken at face value, it looks like whoever snagged this data also obtained the private encryption key and simply decrypted the vast bulk (but not all of) the protected values.”
The dump has 73,481,539 lines, 49 million unique email addresses and nearly 44 million decrypted Social Security numbers. Hunt found 153,000 of his own subscribers in it, and the ones he asked confirmed their data was real. AT&T says it sees no evidence of a breach and the data did not come from it. Encrypting the SSNs means nothing when the key walks out the door with them.