AT&T Lawsuit: Data Breach, Overcharging & Consumer Rights Claims

The 2024 AT&T Data Breach: What Was Exposed

In March 2024, AT&T disclosed that personal data belonging to approximately 73 million current and former customers had been exposed in a data breach that appeared to originate from a 2021 incident. The compromised data set included Social Security numbers, account passcodes, full names, email addresses, mailing addresses, phone numbers, and dates of birth -- essentially a comprehensive identity theft toolkit for every affected individual.

The breach is particularly significant because AT&T initially denied that the leaked dataset, which had circulated on dark web forums since 2021, was authentic. Only after a security researcher confirmed the data's validity did AT&T acknowledge the breach. This delayed disclosure is a centerpiece of the litigation: plaintiffs allege AT&T knew or should have known about the breach years before notifying customers, depriving them of the opportunity to take protective action.

A separate AT&T data breach disclosed in July 2024 involved the theft of call and text metadata for virtually all AT&T wireless customers during a six-month window in 2022, affecting approximately 110 million customers. This second breach forms the basis of additional privacy and wiretapping claims. Related: Toyota car tracking data lawsuit.

Hidden Fee and Billing Practice Claims

Separate from the data breach litigation, AT&T faces ongoing class action claims challenging its billing practices. The lawsuits allege that AT&T charges customers undisclosed administrative fees, "Economic Adjustment Charges," and other line items that are not clearly disclosed at the time of contract signing and are raised unilaterally mid-contract without adequate notice.

California and several other states have strong consumer protection laws requiring that advertised prices reflect the total out-of-pocket cost to the consumer. Plaintiffs allege that AT&T's advertised monthly rates are materially lower than what customers actually pay once administrative fees are added, constituting deceptive pricing under the FTC Act and state unfair competition laws. The company has faced similar claims previously and reached settlement agreements in state courts without admitting liability.

Call Recording and Wiretapping Claims

A third category of AT&T litigation involves allegations that AT&T records customer service calls without adequate consent in violation of state wiretapping laws, particularly California's two-party consent statute (Penal Code §632). California law requires all parties to a telephone call to consent to recording; a company's generic disclosure that calls "may be recorded for quality assurance" has been found insufficient in multiple cases.

Class members in the call recording cases include California residents who called AT&T customer service and were recorded without explicit, at-the-time consent. Damages under California's wiretapping statute are statutory, meaning class members may be entitled to a fixed amount per violation rather than needing to prove actual harm -- which makes class certification and settlement more straightforward.

Who Qualifies and What to Do Now

For the data breach claims: Any current or former AT&T customer whose Social Security number, passcode, or other sensitive personal data was included in the March 2024 breach disclosure may have claims. AT&T notified affected customers by mail and email in 2024, and provided free credit monitoring. Receiving a breach notification does not waive your right to participate in class action litigation. See also: Mr. Cooper Lawsuit.

For the billing claims: AT&T customers who were charged undisclosed fees during their contract period, particularly those in states with strong consumer protection laws, should consult with an attorney. For call recording claims: California residents who called AT&T customer service in recent years may qualify.

Litigation Status in 2026

The 2024 data breach class actions have been consolidated in the Northern District of Texas, where AT&T is headquartered. Class certification briefing is expected to conclude in late 2026. The volume and severity of the exposed data make this one of the larger data breach class actions currently pending in federal court.

AT&T has not admitted wrongdoing and has filed motions to dismiss certain claims, arguing that plaintiffs cannot demonstrate concrete harm from the breach sufficient to establish Article III standing -- a threshold legal requirement to sue in federal court. Courts have ruled inconsistently on standing in data breach cases, and the AT&T litigation may produce important precedent on this issue.

How to Get Legal Help

If you believe you qualify based on the eligibility criteria described above, the next step is a free consultation with an experienced attorney. Most plaintiff-side attorneys handling these cases work on contingency -- meaning you pay nothing unless your case results in a recovery. Bring any relevant documentation including receipts, correspondence, or evidence of the harm you experienced.

To stay current on case developments, claim deadlines, and settlement news, bookmark this page and subscribe to LawsuitWatch alerts. Coverage is updated as new court filings, settlement announcements, and eligibility changes are made public.