Mobile Carrier Data Retention: AT&T Told the FCC It Keeps Call Records for Five Years, What the 2024 Breach Exposed, and What Businesses Should Check

Your mobile carrier keeps a record of the numbers your company phones call and text, often with the cell tower that handled each one, and AT&T told federal regulators in 2022 that it keeps those call detail records for five years. That matters because years of client, supplier and staff contact history sit in a database you do not control, and in 2024 AT&T confirmed that call and text records for nearly all of its wireless customers were copied from a third-party cloud workspace.

The topic came back in a November 2, 2026 BleepingComputer article, "Your Mobile Carrier Stores Your Call Logs for Years." Cape, a carrier that sells shorter retention, sponsored and wrote that article. We treated it as a lead and checked the FCC, AT&T and Cape documents directly.

How long do mobile carriers keep call logs?

Most carriers do not publish a number. On July 19, 2022, then-FCC Chairwoman Jessica Rosenworcel asked mobile carriers how they retain and share location data. On August 25, 2022, the FCC published responses from what it called "the nation's 15 top mobile carriers." It also asked its Enforcement Bureau to investigate whether carriers fully disclose how they use and share geolocation data.

AT&T's reply, dated August 3, 2022, gives exact periods. Its records policy sets "a retention period of no more than 13 months for information that identifies the current or past location of a specific individual's device and five years for historical call detail records, which include cell site location information."

Confirmed: AT&T's stated policy as of 2022. Not known: whether that policy has changed, or what each of the other carriers keeps today. We did not check the other responses one by one, so we quote no figures for them.

What is in a call detail record?

A call detail record (CDR) is a carrier's log of a call or text. It is metadata, not content: it holds no voices and no message text. It typically shows the numbers on both ends, when the call or text happened and how long a call lasted. Many records also show the cell site that handled the connection, which places the phone in a rough area. One line looks harmless. Five years of lines show who your company talks to, how often, and where your people were at the time.

What the AT&T call log breach showed

AT&T's Form 8-K, dated July 12, 2024, says threat actors got into an AT&T workspace on a third-party cloud platform and took files between April 14 and April 25, 2024. The files held call and text records from roughly May 1 to October 31, 2022, plus January 2, 2023. They covered nearly all AT&T wireless customers and the customers of mobile virtual network operators (MVNOs), the smaller carriers that run on AT&T's network.

The records listed the numbers each line interacted with, how many interactions there were and total call time by day or month. Some records also included cell site identification numbers. AT&T said the files had no call or text content, no Social Security numbers or dates of birth, and no names. It also noted that public online tools can often match a phone number to a name.

The retention lesson is simple: records from 2022 were still sitting in a cloud workspace in 2024, and that is how they came to be stolen.

Why carrier data retention matters for a business

• Confidential relationships. The numbers a law firm, medical practice, accounting firm or company in the middle of an acquisition calls can reveal its clients and deals, sometimes before anything is announced.
• Convincing phishing. Attackers who know which numbers your staff call regularly can pretend to be those contacts.
• Legal discovery. AT&T told the FCC it must answer valid subpoenas from civil litigants and criminal defendants for call detail records, which may include location. The longer records are kept, the longer they can be demanded in someone else's legal case.
• You do not hold the copy. Your own security can be strong and this data can still leak from the carrier or its vendors.

What about carriers that promise shorter retention?

Cape says it deletes call logs after one day (24 hours) and uses them only for billing and spam detection. It says the security firm Trail of Bits audited this feature in May and July 2026. In Cape's own account of the audit, the auditor found that an insider with database access could link daily usage totals back to individual subscribers. Cape says it then removed a reference to anonymous storage from its feature description and now deletes daily totals once they are 60 days old.

That is a vendor describing its own audit, and we have not reviewed the audit's full scope. Whatever carrier you use, ask for a written retention period and independent evidence, not a marketing line.

What to do this week

If your company runs its own phone or messaging servers, you decide how long records are kept. Our self-hosting infrastructure page covers that kind of setup.

Mobile carrier data retention questions people are asking

How long does AT&T keep call logs?

In an August 3, 2022 letter to the FCC, AT&T said it keeps historical call detail records, including cell site location information, for five years. It keeps device location information for no more than 13 months.

Do carriers record what is said in calls and texts?

Call detail records are metadata, not content. AT&T said the records stolen in 2024 contained no call or text content.

Was my number in the AT&T call log breach?

Probably, if you used AT&T wireless, or a carrier running on AT&T's network, during the 2022 period covered. AT&T said nearly all of those customers were included and that it would notify current and former customers who were affected.

Can I opt out of my carrier keeping location data?

Not fully. AT&T said customers cannot opt out of sharing location information with law enforcement or emergency services, or when a valid subpoena requires it.

Is a carrier with shorter retention safer?

Keeping less data means there is less to lose in a breach. Get a written policy and independent audit evidence before you rely on the claim.

The bigger lesson

The safest record is one that no longer exists. Carriers, cloud vendors and your own systems keep data longer than most people assume, and every extra year adds exposure. Find out what is kept about your business, shorten what you control, and check any vendor's retention promise for yourself.

Want a second set of eyes on what your systems and vendors keep? See security hardening or get a quote.

Get security alerts by email, plus our free checklist, at security alerts.

Sources: FCC press release, August 25, 2022; AT&T response to the FCC, August 3, 2022; AT&T Form 8-K, July 12, 2024; Cape, Disappearing Call Logs audit; BleepingComputer, sponsored by Cape.