Michael Terpin, founder of the investment group BitAngels, is suing AT&T Inc. for $223.8 million over the theft of about $24 million in cryptocurrency from his personal accounts.

In his lawsuit filed today, Terpin alleges that AT&T is responsible for the theft because a company employee allowed cybercriminals to gain access to his mobile phone account. That, he alleges, allowed them to intercept calls and text messages related to two-factor authentication that allowed them to steal cryptocurrency from Terpin’s accounts.

In many similar cases, a cybercriminal manages to gain control of an account through simple impersonation. But Terpin claims that not only was AT&T aware of attempts to hijack his account and had placed “vaunted additional protection on his account after an earlier incident,” an employee at AT&T helped facilitate the fraud.

“AT&T does not improve its protections even though it knows from numerous incidents that some of its employees actively cooperate with hackers in SIM swap frauds by giving hackers direct access to customer information and by overriding AT&T’s security procedures,” the complaint claims. “In recent incidents, law enforcement has even confirmed that AT&T employees profited from working directly with cyber terrorists and thieves in SIM swap frauds.”

The lawsuit goes on to detail a number of arrests by the Federal Bureau of Investigation in which cybercriminals stole varying amounts from cryptocurrency accounts by hijacking AT&T accounts with the assistance of low-level AT&T customer service representatives.

“AT&T’s studied indifference to protecting its customers’ privacy and financial assets is a metastasizing cancer, threatening hundreds of millions of unsuspecting AT&T’s customers,” Pierce O’Donnell, lead counsel for Terpin, said in a statement. “Our client had no idea when he initially signed up, nor when later he was promised the highest level of security for his account, that low-level retail employees with access to AT&T records, or people posing as them, can be bribed by criminals to override every system that AT&T advertises as unassailable.”

Not holding back, Terpin alleges 16 counts of fraud, gross negligence, invasion of privacy, unauthorized disclosure of confidential customer records, violation of a consent decree, failure to supervise its employees and investigate their criminal background and related charges.

“What AT&T did was like a hotel giving a thief with a fake ID a room key and a key to the room safe to steal jewelry in the safe from the rightful owner,” the lawsuit concludes.

AT&T indicated that it would fight the lawsuit, saying in a statement reported by Reuters that “we dispute these allegations and look forward to presenting our case in court.”

Photo: U.S. Air Force