AT&T has agreed to pay $13 million to settle a Federal Communications Commission (FCC) investigation into a vendor-related data breach that compromised the information of millions of the company's customers.

"Today's announcement should send a strong message that the Enforcement Bureau will not hesitate to take action against service providers that choose to put their customers' data in the cloud, share that data with their vendors, and then fail to be responsible custodians of that data," Loyaan Egal, chief of the Enforcement Bureau and chair of the FCC's privacy and data protection task force, said in a statement.

The January 2023 breach of an unidentified vendor previously used by AT&T led to the exposure of data collected from 8.9 million AT&T customers.

"Under AT&T's contracts, the vendor should have destroyed or returned AT&T customer information when no longer necessary to fulfill contractual obligations, which ended years before the breach occurred," the FCC said in the announcement.

The agency alleged that AT&T failed to ensure the vendor adequately protected customer information and verify that the vendor had either returned or destroyed the data.

Information exposed in the breach included details such as the number of lines on customers' accounts and, in some cases, billing balances and rate plan details. Sensitive information, including credit card numbers, Social Security numbers, and account passwords, was not compromised, according to both AT&T and the FCC.