BleepingComputer asked AT&T if it was possible the data came from a third-party service provider or vendor but has not received a response at this time.

That was my thought: AT&T didn’t get breached and leak the customer data of 71 million themselves. They merely sold that data to a third party who got breached and leaked the customer data of 71 million people.