Daniel Spitler, a 26-year-old bookstore security guard from San Francisco, and Andrew Auernheimer, 25, of Fayetteville, Arkansas, face charges of fraud and conspiracy to access a computer without authorisation.

AT&T revealed the security vulnerability months ago, and US Attorney Paul Fishman said there was no evidence that the two men used the information they acquired for criminal purposes. Authorities cautioned, however, that the information could have wound up in the hands of spammers and scammers.