AT&T Said to Expose iPad Users' Addresses

The group, which calls itself Goatse Security and says it specializes in exposing security vulnerabilities, also obtained the identification number that those iPads use when they communicate over AT&T's network, known as an ICC-ID, according to a member of the group who agreed to speak on condition of anonymity.

AT&T acknowledged the breach, which was first reported by Gawker late Wednesday, but the company sought to minimize its importance.

“AT&T was informed by a business customer on Monday of the potential exposure of their iPad ICC-IDs," AT&T said in a statement. “The only information that can be derived from the ICC-IDs is the e-mail address attached to that device."

AT&T said that by Tuesday it had turned off the feature on its Web site that allowed the group to find the e-mail addresses.

Apple did not respond to a request for comment.

The incident is likely to be a public relations black eye for AT&T, which is Apple's partner for wireless service on the iPhone and iPad in the United States. But security experts said it was not clear whether the breach would have serious consequences for those whose information was obtained.

Even in the wrong hands, e-mail addresses are of limited use beyond sending junk e-mail or attempting to pull people in with so-called phishing attacks, security experts said. What is more, e-mail addresses can be easy to guess. Members of the military are permitted to use only unclassified addresses on devices like the iPad.

But experts said that ICC-ID numbers could, in the right hands, be used to get other information, like an iPad's location.

The breach “should be worrying people a lot," said Nick DePetrillo, an independent security consultant.