Your phone carrier may keep your call records for years

Your phone carrier probably holds a record of who you called, when, for how long and where you were, and it may keep that for years. In 2024, a breach at AT&T put those records for 109 million customers in the hands of thieves. The records existed, so they could be stolen.

What happened

The AT&T breach became public in April 2024. It exposed phone numbers, call and text counts, call durations and location data. The records covered May to October 2022 and January 2023, so they were about two years old when stolen. Both current and former customers were hit.

AT&T said the records held no call content, customer names or Social Security numbers. That is less comforting than it sounds. Call logs alone can show your closest relationships, your home and workplace, and your daily routine.

Why old records matter

If you called a cancer doctor a few years ago, a record likely shows the call, its length and where you stood. A text to a friend afterward leaves its own trail. Call data can also be matched with public information to work out who someone is.

German politician Malte Spitz showed how much this adds up to. In 2011 he sued his telecom for his data, got roughly 35,000 records, and used them to replay several years of his life.

Carriers rarely say how long they keep this. Privacy policies tend to say data is kept for "as long as necessary." In 2022, carriers told the FCC chair they kept location data for up to five years. One reason given is to make money from it. Retained logs are used to build profiles sold to ad networks and data brokers, and sometimes handed to the government.

Who is affected

Anyone who was an AT&T customer in 2022 or early 2023 should assume those records are out. The risk is wider than AT&T, though. Salt Typhoon, a China-linked hacking campaign, reportedly compromised every major US carrier. The risk is highest for people who call doctors, lawyers or sources they want kept private.

A note on the source

The article comes from Cape, a mobile carrier that sells privacy as a feature. Cape says it deletes call and text records after 24 hours. Records from partner networks used to dispute bills are kept 30 days. Security firm Trail of Bits audited the feature in May and July 2026 and found no evidence Cape broke two of its claims. Treat the pitch as a carrier's own, with the audit as the part to check.

What to do

The alert box above lists the steps. The short version: find out how long your carrier keeps your records, ask if the answer is vague, and look for independent audits before trusting any carrier's promise.