They would need more than an email address to make a meaningful match in this case, since we're stating the email is unique to AT&T.

That being said, I've never heard of hackers performing Master Data Management but I guess it's possible. I'd hope they'd use something other than full name for their matches...