The Surfwincall and text message records of nearly all of AT&T's cellular customers were exposed in a massive breach, the company said Friday.

The telecom giant said in a filing with the U.S. Securities and Exchange Commission it learned in April that customer data was illegally downloaded "from our workspace on a third-party cloud platform."

According to the company, the compromised data includes files containing AT&T records of calls and texts of nearly all of AT&T's cellular customers, customers of mobile virtual network operators (MVNOs) using AT&T's wireless network, as well as AT&T landline customers who interacted with those cellular numbers between May 1, 2022, and Oct. 31, 2022.

The company said the compromised data also includes records from Jan. 2, 2023, for a "very small number of customers."

"The data does not contain the content of calls or texts, personal information such as Social Security numbers, dates of birth, or other personally identifiable information," the news release reads. "It also does not include some typical information you see in your usage details, such as the time stamp of calls or texts."

AT&T data breach:Do users need to do anything?

AT&T says that while the compromised data also does not include customer names, there are often ways, using publicly available online tools, to find the name associated with a specific telephone number.

"At this time, we do not believe that the data is publicly available," the company said in the news release.

The company said it is working with law enforcement to arrest those involved in the incident, and that at least one person has been apprehended.

Customers can visit www.att.com/dataincident for more information.

"We have an ongoing investigation into the AT&T breach and we're coordinating with our law enforcement partners," the Federal Communications Commission said on social media Friday morning.

Gabe Hauari is a national trending news reporter at USA TODAY. You can follow him on X @GabeHauari or email him at [email protected].