AT&T Data Breach Lawsuit: The $177 Million Settlement

The Two Breaches

AT&T disclosed two separate data breaches in 2024. In March, it confirmed that a dataset affecting about 73 million current and former account holders — including names, birth dates and Social Security numbers — had surfaced on the dark web. In July, it disclosed a second incident in which attackers downloaded records of calls and texts for “nearly all” of its cellular customers from a third-party cloud platform. The first breach exposed the kind of identity data used for fraud; the second exposed a detailed map of who customers communicated with.

Together they made 2024 a landmark year of exposure for one of the largest US carriers.

The Settlement

In 2024, AT&T agreed to a $177 million settlement to resolve class-action claims from both breaches, splitting the fund between the two settlement classes — roughly $149 million for those affected by the first breach and about $28 million for the second. Individual payments varied with documented losses, with higher amounts (up to several thousand dollars) for people who could show specific harm. The claims deadline passed in late 2025, and a final-approval hearing was held in early 2026, with payments to follow if approved.

As with most breach settlements, the largest payouts required proof of actual out-of-pocket losses tied to the breach.

What Customers Should Know

If your data may have been exposed, the standard protections apply: consider a credit freeze, watch your statements and credit reports, and be alert to phishing that uses details a criminal could have pulled from the breach. Never pay a fee to a site claiming it can “recover” settlement money for you; legitimate settlement administration is free through the official channel.