Over 110 million AT&T customers had their personal information exposed in two major data breaches during 2019 and 2024. Consumers sought compensation through a class-action lawsuit alleging that the company failed to adequately protect customer data or provide prompt notifications.
Settlement Details and Timeline
Although AT&T did not admit to any wrongdoing, the company agreed to pay $177 million in restitution to the settlement class. More than 4.9 million eligible customers filed a claim.
AT&T can still appeal the court’s decision until November 2. If no appeal occurs, the court has 10 days to issue a final approval. Payouts will then be issued electronically or by mail within 60 days of that final approval, meaning claimants could potentially receive their money by early 2027.
Payout Amounts and Tiers
Individuals who filed a valid claim and provided documentation of financial losses could receive up to $7,500, depending on the specific settlement class.
As part of the AT&T 1 Data Incident settlement class for the 2019 breach, anyone whose Social Security number was stolen and who can prove financial losses from the hack is eligible for up to a $5,000 check. For the 2024 breach under the AT&T 2 Data Incident settlement class, anyone proving financial loss is eligible for up to a $2,500 check. Customers affected by both breaches who have documentation for each can receive up to a $7,500 check.
However, more than 3.7 million eligible claimants who submitted no documentation of losses will receive lower payouts ranging from $6.50 to $40 through a tiered distribution system. These cash payments will be distributed pro rata based on the remaining funds in the total settlement allotment, and all payout amounts remain estimates.
Background on the Breaches
The 2019 hack affected 65.4 million former customers and 7.6 million active account holders, exposing sensitive details such as Social Security numbers, birth dates, and full legal names. The breach prompted AT&T to reset passwords for every affected customer.
The 2024 breach impacted nearly 109 million wireless customers, exposing call and text records, timestamps, and cell tower location data from 2022. Because nearly all 73 million people from the first incident were included in the broader pool, the total number of impacted customers is capped at around 110 million, with personal information appearing on the dark web after the company delayed public acknowledgment for several weeks.
Hackers from the UNC5537 group, an affiliate of the ShinyHunters group, claimed responsibility for the 2024 breach as part of a larger campaign targeting Snowflake databases across multiple companies. Two individuals were arrested in connection with the case.
Claimants seeking further information or updates can contact the settlement administrator by visiting telecomdatasettlement.com or calling 833-890-4930.
